LowVulnerabilityLLM-specific
GHSA-782p-5fr5-7fj8: OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
- Identifiers
- CVE-2026-24764GHSA-782p-5fr5-7fj8
- Published
- Record updated
- Affected
- openclaw < 2026.2.3
- Fixed in
- 2026.2.3
- released February 4, 2026, 12 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
OpenClaw versions before 2026.2.3 let Slack channel topic and description metadata enter the model's system prompt when the Slack integration is enabled. That treats untrusted channel text as higher-trust input, and in deployments with tool execution enabled, a successful injection could cause unintended tool invocations or data exposure.
Mitigation
Upgrade the npm package `openclaw` to version 2026.2.3 or later. If Slack is not used, no action is required.
Topics
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
- InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)