AVID-2026-R0216

Description

OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand (CVE-2026-25157)

Details

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=… would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29.

References

Affected or Relevant Artifacts

Developer: openclaw
Deployer: openclaw
Artifact Details:

Type	Name
System	openclaw

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score	7.8
Base Severity	🔴 High
Attack Vector	LOCAL
Attack Complexity	🔴 High
Privileges Required	NONE
User Interaction	REQUIRED
Scope	CHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-78	CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2026-02-04
Version: 0.3
AVID Entry