Openclaw EUVD-2026-13951

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H) with a base score of 6.4 indicates moderate severity but requires nuanced interpretation. Attack vector is network-accessible (AV:N), which increases exposure, but attack complexity is high (AC:H) and requires legitimate low-privilege credentials (PR:L) plus user interaction (UI:R), which together significantly constrain real-world exploitability. The impact is severe: no confidentiality loss but high integrity and availability damage. The absence of confidentiality impact and the high complexity/interaction requirements suggest this is not a trivial remote wipe scenario. However, the availability and integrity impact combined with network accessibility makes this a legitimate concern for environments where OpenClaw is deployed with untrusted users. Exploitation likely requires social engineering (misleading approval text) to trick users into executing commands, making this operationally feasible but not automatically triggerable. The availability of a vendor patch and GitHub commits (0f0a680d3df81739ea5088a2f88e65f938b7936b and 55cf92578d266987e390c4bf688196af98eac748) indicates active vendor response. Without confirmed KEV status or public POC, this appears to be in the early disclosure phase, making prompt patching appropriate but not emergency-level.

An attacker with valid low-privilege credentials on an OpenClaw installation crafts a command such as 'system.run("echo approved", "; rm -rf /data")' and presents it to a user with a misleading approval message like 'Approve minor configuration update'. The high attack complexity (AC:H) is overcome through social engineering: the approval text appears benign, but the positional argv injection causes the shell-wrapper to execute both the echo command and the hidden destructive command. Because UI:R is required, the attacker must convince a higher-privileged user to click 'approve', but once triggered, the arbitrary command executes with the privileges of the OpenClaw process, potentially compromising data integrity and system availability. No public POC is known at this time, but the attack is feasible for insiders or compromised accounts with system.run access.