OpenClaw versions prior to 2026.2.15 contain a critical command injection vulnerability that allows an attacker to manipulate AI system prompts through crafted directory names.

This vulnerability involves the improper neutralization of special elements (CWE-77) where the workspace directory path is embedded into the AI system prompt without sanitization. An unauthenticated attacker can trigger this by forcing the application to run within a directory containing control or format characters, effectively injecting unauthorized instructions into the model.

The ability to inject instructions into an AI assistant poses a significant risk to data integrity and system control, as the AI may be coerced into performing unintended actions or disclosing sensitive information. With a CVSS score of 7.8, this vulnerability represents a high risk to organizational security, particularly if the AI assistant has access to sensitive files or internal tooling.

Immediate Action: Upgrade the OpenClaw package to version 2026.2.15 or later, which implements mandatory sanitization of workspace paths to strip control and format characters.

Proactive Monitoring: Review access logs and workspace configurations for unusual directory naming conventions or unexpected AI output patterns that deviate from established operational baselines.

Compensating Controls: Ensure that the application process is executed within a restricted directory structure where naming conventions are strictly enforced and monitored to prevent the inclusion of control or Unicode formatting characters.

Public Exploit Available: No (exploit_available unknown)

Given the potential for complete compromise of the AI agent's logic, organizations utilizing OpenClaw must prioritize the update to version 2026.2.15. Failure to patch allows for the potential manipulation of the agent's core instructions, creating a persistent security risk that cannot be fully mitigated by environmental controls alone.