{"id":"CVE-2026-24764","aliases":["EUVD-2026-8120","GHSA-782p-5fr5-7fj8"],"status":"published","title":"OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions","description":"OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00239,"percentile":0.15011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-94"],"published":"2026-02-17T18:40:11Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.2.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.2.3"}]}]}],"products":[{"vendor":"clawdbot","product":"clawdbot"},{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-782p-5fr5-7fj8","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/35eb40a7000b59085e9c638a80fd03917c7a095e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.3","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24764","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-782p-5fr5-7fj8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24764.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-24764","title":"OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions","description":"OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.","status":"published","published":"2026-02-19T01:10:17.54Z","modified":"2026-02-19T17:45:16.959Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-8120","description":"OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.","status":"published","published":"2026-02-19T01:10:17Z","modified":"2026-02-19T17:45:16Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:48:37.056368Z"}],"ghsa":[{"id":"GHSA-782p-5fr5-7fj8","title":"OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions","description":"## Summary\nWhen the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt.\n\n## Impact\nPrompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input.\n\nThis is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure.\n\n## Affected Packages / Versions\n- npm: `openclaw` \u003c 2026.2.3\n\n## Patched Versions\n- npm: `openclaw` \u003e= 2026.2.3\n\n## Mitigation\n- If you do not use Slack: no action required.\n- If you use Slack: upgrade to a patched version.\n\n## Fix Commit(s)\n- 35eb40a7000b59085e9c638a80fd03917c7a095e\n\nThanks @KonstantinMirin for reporting.","status":"published","published":"2026-02-17T18:40:11Z","modified":"2026-02-19T21:14:24Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"nvd":[{"id":"CVE-2026-24764","description":"OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.","status":"published","published":"2026-02-19T07:17:44.957Z","modified":"2026-06-17T10:23:33.16Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-24764","title":"OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions","description":"OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.","status":"published","published":"2026-02-19T01:10:17.54Z","modified":"2026-10-28T02:31:00.35568919Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-782p-5fr5-7fj8","title":"OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions","description":"## Summary\nWhen the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt.\n\n## Impact\nPrompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input.\n\nThis is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure.\n\n## Affected Packages / Versions\n- npm: `openclaw` \u003c 2026.2.3\n\n## Patched Versions\n- npm: `openclaw` \u003e= 2026.2.3\n\n## Mitigation\n- If you do not use Slack: no action required.\n- If you use Slack: upgrade to a patched version.\n\n## Fix Commit(s)\n- 35eb40a7000b59085e9c638a80fd03917c7a095e\n\nThanks @KonstantinMirin for reporting.","status":"published","published":"2026-02-17T18:40:11Z","modified":"2026-02-19T21:32:55.947394Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}