{"data":{"id":"baa23102-8d55-4997-894e-4c9f52f382c9","title":"GHSA-g27f-9qjv-22pm: OpenClaw log poisoning (indirect prompt injection) via WebSocket headers","summary":"OpenClaw versions up to and including 2026.2.12 logged WebSocket request headers such as Origin and User-Agent without neutralization or length limits when a connection closed before the connect handshake completed. An unauthenticated client that can reach the gateway can send crafted header values that are written into core logs. The main risk is indirect prompt injection (log poisoning) when those logs are later read by an LLM, and the advisory says impact is limited if logs are not fed into an LLM or other automation.","solution":"Fixed in 2026.2.13 (openclaw >= 2026.2.13), which sanitizes and truncates header values written to gateway logs, including removal of control and format characters and length limiting. Fix commits: d637a263505448bf4505b85535babbfaacedbaac, e84318e4bcdc948d92e57fda1eb763a65e1774f0 (PR #15592). Additional workarounds: treat logs as untrusted input during AI-assisted debugging (sanitize or escape them, and do not auto-execute instructions derived from logs), restrict gateway network exposure, and apply reverse-proxy limits on header size where applicable.","labels":["security","safety"],"sourceUrl":"https://github.com/advisories/GHSA-g27f-9qjv-22pm","publishedAt":"2026-02-17T21:31:39.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.13 (fixed: 2026.2.13)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-g27f-9qjv-22pm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-14T03:20:08.219Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:40:59.861Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.13","matchedVersion":"2026.2.13","fixReleasedAt":"2026-02-14T03:20:08.219Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:59.713Z"}]}}