Openclaw CVE-2026-35651

The risk profile presents a moderate real-world threat with important nuance. CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N indicates remote unauthenticated attack over the network with low complexity, but critically requires user interaction (UI:R) and impacts only integrity (I:L) with no confidentiality or availability impact. The EPSS score of 4.3 suggests relatively low exploitation probability in the wild. However, the SSVC context matters: while this is not a high-severity vulnerability, the attack surface is real-any user reviewing tool metadata in approval prompts becomes a potential target for social engineering via terminal spoofing. The lack of confirmed active exploitation (no KEV status) and the availability of a vendor patch further reduce immediate risk. Organizations should prioritize this for patching but not elevate to critical status; the attack requires specific user action and deliberate malicious tool metadata injection, limiting automated exploitation potential.

An attacker with knowledge of OpenClaw's tool registry submission process crafts a malicious tool with metadata containing embedded ANSI escape sequences in the tool title or description field (for example, sequences that hide or replace text). When an authorized user opens the approval prompt to review and authorize this tool's execution, the ANSI sequences render in their terminal, causing legitimate permission information to be obscured or replaced with attacker-controlled content. The user, deceived by the spoofed output, approves execution of the malicious tool. No publicly available exploit code has been identified; exploitation requires deliberate crafting of malicious metadata and relies on social engineering via terminal spoofing.