Vulnerabilities

TI-2026-17788 CVE-2026-22178 · GHSA-c6hr-w26q-c636

OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata

LOW 36

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00331 Published 2026-03-18 Fixed in 2026.2.19 CWE-1333

TI-2026-17782 CVE-2026-22171 · GHSA-vj3g-5px3-gr46

OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming

MEDIUM 44

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00353 Published 2026-03-18 Fixed in 2026.2.19 CWE-22

Vulnerabilities

Filters

OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata

OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming