CVE-2026-25157

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25157", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.822Z", "datePublished": "2026-02-04T19:55:38.493Z", "dateUpdated": "2026-02-05T14:32:32.289Z"}, "containers": {"cna": {"title": "OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585"}], "affected": [{"vendor": "openclaw", "product": "openclaw", "versions": [{"version": "< 2026.1.29", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:55:38.493Z"}, "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29."}], "source": {"advisory": "GHSA-q284-4pvr-m585", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:23:09.955087Z", "id": "CVE-2026-25157", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:32:32.289Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25157", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-05T14:23:09.955087Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:23:10.569Z"}}], "cna": {"title": "OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand", "source": {"advisory": "GHSA-q284-4pvr-m585", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openclaw", "product": "openclaw", "versions": [{"status": "affected", "version": "< 2026.1.29"}]}], "references": [{"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585", "name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:55:38.493Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25157", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:32:32.289Z", "dateReserved": "2026-01-29T15:39:11.822Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T19:55:38.493Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openclaw", "vendor": "openclaw", "versions": [{"status": "affected", "version": "< 2026.1.29"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "4801AF60-B3F7-4C05-A4A1-F8443F445ACD", "versionEndExcluding": "2026.1.29", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29."}, {"lang": "es", "value": "OpenClaw es un asistente personal de IA. Antes de la versi\u00f3n 2026.1.29, existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo a trav\u00e9s de la Ruta Ra\u00edz del Proyecto en sshNodeCommand. La funci\u00f3n sshNodeCommand constru\u00eda un script de shell sin escapar correctamente la ruta del proyecto proporcionada por el usuario en un mensaje de error. Cuando el comando cd fallaba, la ruta sin escapar se interpolaba directamente en una declaraci\u00f3n echo, permitiendo la ejecuci\u00f3n arbitraria de comandos en el host SSH remoto. La funci\u00f3n parseSSHTarget no validaba que las cadenas de destino SSH no pudieran comenzar con un guion. Un objetivo proporcionado por el atacante como -oProxyCommand=... ser\u00eda interpretado como una bandera de configuraci\u00f3n SSH en lugar de un nombre de host, permitiendo la ejecuci\u00f3n arbitraria de comandos en la m\u00e1quina local. Este problema ha sido parcheado en la versi\u00f3n 2026.1.29."}], "id": "CVE-2026-25157", "lastModified": "2026-06-17T10:24:12.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25157", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:23:09.955087Z", "version": "2.0.3"}}]}, "published": "2026-02-04T20:16:06.577", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:45:56.440622+00:00", "value": {"mitigation_remediation": ["Upgrade OpenClaw to version 2026.1.29 or later to apply the OS command injection fix.", "Validate or sanitize the Project Root Path value before incorporating it into shell commands.", "Reject SSH target strings that begin with a dash or enforce explicit hostname validation to prevent unintended SSH configuration flags."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is OpenClaw as distributed by the vendor openclaw. All releases prior to version 2026.1.29 are vulnerable. The problem exists in the Node.js implementation of OpenClaw and does not depend on the operating system; however, the vulnerability is reported to affect macOS platforms as well due to the reliance on SSH utilities. Users should verify that they are running a patched version after 2026.1.29.", "description_and_impact": "OpenClaw, a personal AI assistant, was found to allow malicious actors to execute arbitrary shell commands on the SSH host when interacting with the sshNodeCommand function. The weakness stemmed from building a shell script that interpolated the user\u2011supplied Project Root Path directly into an echo statement in an error message without proper escaping. Likewise, the parseSSHTarget function accepted SSH target strings beginning with a dash, allowing an attacker to inject SSH configuration flags such as \u2013oProxyCommand that would be interpreted as command\u2011line options rather than a hostname. Consequently, an attacker could run arbitrary commands on the remote machine or even the local machine. This vulnerability is classified as a severe OS Command Injection flaw (CWE\u201178).", "risk_and_exploitability": "The CVSS score for this flaw is 7.8, indicating high severity, while the EPSS score is below 1%, suggesting low current exploit probability. The vulnerability is not listed in the CISA KEV catalog, implying that no widespread exploitation has been formally identified to date. Nevertheless, the flaw permits remote code execution through both a server\u2011side command injection vector and a client\u2011side SSH configuration injection vector, meaning that any user with the ability to specify a project path or SSH target string could potentially compromise the target machine if these inputs are not validated."}}}}, "created": "2026-02-05T11:40:11.222843+00:00", "updated": "2026-04-18T14:00:02.173600+00:00", "vendors": ["openclaw", "openclaw$PRODUCT$openclaw"]}