openclaw-android EUVD-2026-42626

Q: What is the CVSS score of EUVD-2026-42626?

EUVD-2026-42626 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-15193 LOW

Command Injection (CWE-77)

2026-07-09 cna@vuldb.com

GHSA-65q5-j698-45qc

Java Google Command Injection

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local-only vector with low-privilege requirement matches description; unchanged scope and limited C/I/A reflect Android sandbox containment.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:38 vuln.today

DescriptionCVE.org

A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com/openclaw/android/JsBridge.kt of the component Android WebView Bridge. This manipulation causes os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

AnalysisAI

OS command injection in the Android WebView JavaScript bridge of openclaw-android (versions up to 0.4.0) permits a local, low-privileged attacker to execute arbitrary OS commands through the JsBridge.kt component. Exploitation is constrained to local device access, limiting real-world blast radius, but a publicly disclosed proof-of-concept exists per the CVSS 4.0 E:P supplemental metric. No patch has been released - a remediation pull request (#137) is pending acceptance, leaving all users on version 0.4.0 or earlier exposed.

Technical ContextAI

The affected component is android/app/src/main/java/com/openclaw/android/JsBridge.kt, which implements a JavaScript-to-native bridge inside an Android WebView. WebView bridges expose native Android APIs to JavaScript executing within a sandboxed web context; when such bridges pass caller-supplied data into shell commands without sanitization or escaping, CWE-77 (Improper Neutralization of Special Elements Used in a Command) results. The tags confirm a Java/Kotlin codebase targeting the Google Android platform. The vulnerability class is classic injection at the trust boundary between the web rendering layer and the OS layer - the bridge fails to treat JavaScript-supplied input as untrusted.

RemediationAI

No vendor-released patch is available at time of analysis. A pull request to fix the issue has been submitted (https://github.com/AidanPark/openclaw-android/pull/137) but awaits maintainer acceptance and a tagged release. Users should monitor the repository for merge and a subsequent version release above 0.4.0 and upgrade immediately upon availability. In the interim, the primary compensating control is to avoid installing or running openclaw-android in environments where untrusted local users have physical or shell access to the Android device. If the application is deployed in a managed or shared-device context, restricting the WebView to load only trusted, internally-controlled content would reduce the injection surface, though this requires application-level reconfiguration not available to end users. Given the local-only attack vector, network-level controls provide no meaningful mitigation.