GitHub Advisoryadvisory · npm

GHSA-782p-5fr5-7fj8 OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

LOW Published 2026-02-17 Modified 2026-02-19 Official page ↗
Aliases
CVE-2026-24764
Ecosystem
npm
Packages
openclaw
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-74, CWE-94
Reviewed
2026-02-17

Affected packages

• npm openclaw: < 2026.2.3 → fixed in 2026.2.3

Description

Summary When the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt. Impact Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure. Affected Packages / Versions • npm: `openclaw` = 2026.2.3 Mitigation • If you do not use Slack: no action required. • If you use Slack: upgrade to a patched version. Fix Commit(s) • 35eb40a7000b59085e9c638a80fd03917c7a095e Thanks @KonstantinMirin for reporting.

Related

Alias · CVE (1)

  • CVE-2026-24764 OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References