OpenClaw Agent Platform Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability has been identified in OpenClaw Agent Platform version 2026.2.6 and earlier. This vulnerability arises from a request-side prompt injection attack, which allows attackers to execute arbitrary code by injecting malicious prompts that are not properly validated before being processed.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where OpenClaw is running.
Reproduction
The vulnerability can be reproduced by sending a request that includes a crafted prompt injection. This injected prompt can manipulate the application's behavior to execute unauthorized commands. The proof-of-concept demonstration available on Bilibili shows this exploitation in action.
Remediation
Users are advised to update to the latest version of OpenClaw Agent Platform.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.