Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M
CVE-2026-24764OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
Low 3.7
In plain English
A low-severity injection in clawdbot from clawdbot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled, channel metadata (topic/description) can be incorporated into the model's system prompt. Prompt injection is a documented risk for LLM-driven systems. This issue increases the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This issue has been fixed in version 2026.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | openclaw | 2026.2.3 | GHSA-782p-5fr5-7fj8 |
Affected products (as reported)
Weakness: CWE-74, CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N