This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-25593 | BDVDB-2026-314231 Detail

openclawopenclaw

Description#

OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.

Weaknesses#

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-306 Missing Authentication for Critical Function

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.