What is the CVSS score of CVE-2026-27001?

CVE-2026-27001 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-27001?

OpenClaw versions prior to 2.26.2.15 expose sensitive file system paths through unsanitized workspace directory information embedded in AI assistant prompts, potentially enabling attackers to map…. A patch is available.

How to fix or mitigate CVE-2026-27001?

Within 24 hours: Identify all OpenClaw installations and their versions across the organization. Within 7 days: Apply vendor patch to upgrade all instances to version 2026.2.15 or later; test in non-production environment first. Within 30 days: Conduct audit of OpenClaw usage logs to identify if workspace paths were accessed or exposed through AI interaction logs.

AI / ML CVE-2026-27001

HIGH

Command Injection (CWE-77)

2026-02-20 security-advisories@github.com

GHSA-2qj5-gwg2-xwc4

Command Injection AI / ML Openclaw

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

Patch released

Feb 20, 2026 - 18:13 nvd

Patch available

CVE Published

Feb 20, 2026 - 00:16 nvd

HIGH 7.8

DescriptionGitHub Advisory

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contains control/format characters (for example newlines or Unicode bidi/zero-width markers), those characters could break the prompt structure and inject attacker-controlled instructions. Starting in version 2026.2.15, the workspace path is sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators. Workspace path resolution also applies the same sanitization as defense-in-depth.

AnalysisAI

OpenClaw versions prior to 2026.2.15 fail to sanitize workspace directory paths before injecting them into LLM prompts, allowing local attackers with execution privileges to inject malicious instructions through control characters and Unicode markers in directory names. An attacker can exploit this prompt injection vulnerability to manipulate the AI assistant's behavior and execute unintended commands. A patch is available in version 2026.2.15 and later.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects Openclaw. OpenClaw is a personal AI assistant. Prior to version 2026.2.15, OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contains control/format characters (for example newlines or Unicode bidi/zero-width markers), those characters could break the prompt structure and inject attacker-controlled instructions. Starting in version 2026.2.15, the workspace path is saniti