Clawscan
Monthly
Local users with low privileges can bypass the ClawScan Static scanner (clawscan-static) in OpenClaw ClawScan up to and including version 0.1.6 by supplying scan targets whose paths the tool wrongly treats as skippable, allowing content such as packaged Python bytecode to go uninspected while still being processed. The flaw is a path-classification error in shouldSkipTargetPath (internal/runner/runner.go), so the protection mechanism fails rather than being memory-corrupted, and impact is limited to low confidentiality, integrity, and availability effects (CVSS 4.0 base score 1.9; independently assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (a proof-of-concept scanner-bypass project) and exploitation requires the victim to actually run ClawScan against attacker-supplied content; there is no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fix in version 0.1.7.
Incomplete comparison logic in OpenClaw ClawScan's built-in static scanner (internal/runner/static_scanner.go) through version 0.1.6 lets packaged Python bytecode slip past the deterministic text scan, so malicious skills or OpenClaw plugins can pass inspection undetected. The vendor fix in v0.1.7 (commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41) explicitly adds flagging of packaged Python bytecode as opaque executable content. A publicly available exploit (GitHub issue #40) demonstrates the bypass, but the flaw is local-only, requires a low-privileged local user plus passive user interaction, and yields only a low integrity impact (CVSS 4.0 base 0.9).
ClawScan 0.1.6 and earlier misclassifies NUL-obfuscated or otherwise ambiguous files as opaque binary content, so its built-in static scanner skips them and malicious OpenClaw skill or plugin code passes inspection undetected. Exploitation requires local access and the victim to run or act on a ClawScan report, giving the attacker a way to smuggle hostile code past the only automated gate. Public exploit code exists (GitHub issue #42), and the defect is resolved in 0.1.7 via commit 04401337b3adb9343bd338b21e5e258bf49ca9c8; CVSS 4.0 base score is 2.4, reflecting the limited integrity-only, local impact.
Local users with low privileges can bypass the ClawScan Static scanner (clawscan-static) in OpenClaw ClawScan up to and including version 0.1.6 by supplying scan targets whose paths the tool wrongly treats as skippable, allowing content such as packaged Python bytecode to go uninspected while still being processed. The flaw is a path-classification error in shouldSkipTargetPath (internal/runner/runner.go), so the protection mechanism fails rather than being memory-corrupted, and impact is limited to low confidentiality, integrity, and availability effects (CVSS 4.0 base score 1.9; independently assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (a proof-of-concept scanner-bypass project) and exploitation requires the victim to actually run ClawScan against attacker-supplied content; there is no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fix in version 0.1.7.
Incomplete comparison logic in OpenClaw ClawScan's built-in static scanner (internal/runner/static_scanner.go) through version 0.1.6 lets packaged Python bytecode slip past the deterministic text scan, so malicious skills or OpenClaw plugins can pass inspection undetected. The vendor fix in v0.1.7 (commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41) explicitly adds flagging of packaged Python bytecode as opaque executable content. A publicly available exploit (GitHub issue #40) demonstrates the bypass, but the flaw is local-only, requires a low-privileged local user plus passive user interaction, and yields only a low integrity impact (CVSS 4.0 base 0.9).
ClawScan 0.1.6 and earlier misclassifies NUL-obfuscated or otherwise ambiguous files as opaque binary content, so its built-in static scanner skips them and malicious OpenClaw skill or plugin code passes inspection undetected. Exploitation requires local access and the victim to run or act on a ClawScan report, giving the attacker a way to smuggle hostile code past the only automated gate. Public exploit code exists (GitHub issue #42), and the defect is resolved in 0.1.7 via commit 04401337b3adb9343bd338b21e5e258bf49ca9c8; CVSS 4.0 base score is 2.4, reflecting the limited integrity-only, local impact.