{"data":{"id":"a7b5652e-3a85-471f-9f8a-f89fc23eb2c9","title":"CVE-2026-27487: OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain…","summary":"CVE-2026-27487 affects OpenClaw, a personal AI assistant, in versions 2026.2.13 and below on macOS. The Claude CLI keychain credential refresh path built a shell command to write an updated JSON blob into Keychain via security add-generic-password -w, and because OAuth tokens are user-controlled data, this created an OS command injection risk (CWE-78).","solution":"This issue has been fixed in version 2026.2.14.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27487","publishedAt":"2026-02-21T10:16:13.100Z","cveId":"CVE-2026-27487","cweIds":["CWE-78"],"cvssScore":"7.6","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.14 (fixed: 2026.2.14)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw","Claude CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenClaw OS command injection in macOS Claude CLI keychain credential refresh","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01368,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":["GHSA-4564-pvr2-qq4h"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:44.739Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:40:40.845Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.14","matchedVersion":"2026.2.14","fixReleasedAt":"2026-02-15T02:59:48.267Z","daysToFix":-6,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:40.698Z"}]}}