GHSA-2qj5-gwg2-xwc4: OpenClaw: Unsanitized CWD path injection into LLM prompts

Summary

OpenClaw embedded the current working directory path into the agent system prompt without sanitization. A directory name containing control or format characters, such as newlines or Unicode bidi and zero-width markers, could break the prompt structure and inject attacker-controlled instructions, altering agent behavior or enabling unintended tool use or disclosure of sensitive information. Affected versions of the `openclaw` npm package are those below 2026.2.15.

Mitigation

Fixed in 2026.2.15 (patched versions `>= 2026.2.15`). The workspace path is now sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators, and workspace path resolution applies the same sanitization as defense-in-depth. Fix commit: `6254e96acf16e70ceccc8f9b2abecee44d606f79`.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)