{"data":{"id":"7cb6ec1c-5422-40c5-983a-1efaa54106b3","title":"GHSA-2qj5-gwg2-xwc4: OpenClaw: Unsanitized CWD path injection into LLM prompts","summary":"OpenClaw embedded the current working directory path into the agent system prompt without sanitization. A directory name containing control or format characters, such as newlines or Unicode bidi and zero-width markers, could break the prompt structure and inject attacker-controlled instructions, altering agent behavior or enabling unintended tool use or disclosure of sensitive information. Affected versions of the `openclaw` npm package are those below 2026.2.15.","solution":"Fixed in 2026.2.15 (patched versions `>= 2026.2.15`). The workspace path is now sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators, and workspace path resolution applies the same sanitization as defense-in-depth. Fix commit: `6254e96acf16e70ceccc8f9b2abecee44d606f79`.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2qj5-gwg2-xwc4","publishedAt":"2026-02-18T22:42:29.000Z","cveId":"CVE-2026-27001","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.15 (fixed: 2026.2.15)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00227,"epssCheckedAt":"2026-11-04T12:08:33.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-2qj5-gwg2-xwc4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-16T03:56:42.422Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:40:53.397Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.15","matchedVersion":"2026.2.15","fixReleasedAt":"2026-02-16T03:56:42.422Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:53.201Z"}]}}