CVE-2026-100559
Received Received - Intake

Command Parser Bypass in OpenClaw via Escaped Newlines

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100559
EUVD
EUVD-2026-87491

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw versions before 2026.8.1 have a command parser flaw where escaped newlines trick the system into executing hidden commands. Attackers can bypass allowlist checks by inserting escaped newlines, letting them run unauthorized commands without proper authorization prompts.

Detection Guidance

Check OpenClaw version with 'openclaw --version' or inspect installed packages. Monitor command execution logs for unexpected commands or authorization bypasses. Test input with escaped newlines like 'command\nmalicious_command' to see if hidden commands execute.

Impact Analysis

This vulnerability allows attackers to execute unauthorized commands on your system if you use vulnerable OpenClaw versions. It could lead to data breaches, system compromise, or unauthorized actions depending on the commands available and your environment's configuration.

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially violating data protection requirements under GDPR or HIPAA if it results in unauthorized access to or disclosure of sensitive data. Compliance may be impacted if the flaw enables data breaches or unauthorized system changes.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later immediately. If upgrading is not possible, disable command execution for lower-trust agents or inputs. Review and tighten exec allowlists and authorization policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart