Riskcovery

CVE-2026-24764

OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

State
Published
Severity
3.7 Low
Published
Feb 19, 2026
Updated
Feb 19, 2026
Reserved
Jan 26, 2026

Read the record on cve.org

Description

OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.

Scores

CVSSScoreVectorSource
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NGitHub_M

Weaknesses

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
clawdbotclawdbot
  • < 2026.2.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.