{"data":{"id":"46fd48d5-c324-4cb6-8b56-3f4cd7f02812","title":"GHSA-782p-5fr5-7fj8: OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions","summary":"OpenClaw versions before 2026.2.3 let Slack channel topic and description metadata enter the model's system prompt when the Slack integration is enabled. That treats untrusted channel text as higher-trust input, and in deployments with tool execution enabled, a successful injection could cause unintended tool invocations or data exposure.","solution":"Upgrade the npm package `openclaw` to version 2026.2.3 or later. If Slack is not used, no action is required.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-782p-5fr5-7fj8","publishedAt":"2026-02-17T18:40:11.000Z","cveId":"CVE-2026-24764","cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.3 (fixed: 2026.2.3)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw","Slack"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00239,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-782p-5fr5-7fj8"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-05T01:38:27.585Z","daysToFix":-12,"fixCheckedAt":"2026-10-29T21:41:01.599Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.3","matchedVersion":"2026.2.3","fixReleasedAt":"2026-02-05T01:38:27.585Z","daysToFix":-12,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:41:01.451Z"}]}}