CVE-2026-15193
AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jul 9, 2026
- Updated
- Jul 9, 2026
- Reserved
- Jul 9, 2026
Description
A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com/openclaw/android/JsBridge.kt of the component Android WebView Bridge. This manipulation causes os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
openclaw-androidAidanPark |
|
References
- VDB-377120 | AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injectionvdb-entry
- VDB-377120 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-15193 | CVE Analysis and Reportthird-party-advisory
- Submit #851623 | AidanPark openclaw-android 0.4.0 Arbitrary Command Execution / Policy Bypassthird-party-advisory
- https://github.com/AidanPark/openclaw-android/issues/136exploitissue-tracking
- https://github.com/AidanPark/openclaw-android/pull/137issue-trackingpatch
- https://github.com/AidanPark/openclaw-android/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.