GitHub Advisoryadvisory · npm
GHSA-c6hr-w26q-c636 OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction
MEDIUM
Official page ↗
- Aliases
- CVE-2026-22178
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Weaknesses
- CWE-1333
- Reviewed
- 2026-03-02
Affected packages
• npm openclaw: < 2026.2.19 → fixed in 2026.2.19
Description
Summary
`extensions/feishu/src/bot.ts` constructed `new RegExp()` directly from Feishu mention metadata (`mention.name`, `mention.key`) in `stripBotMention()` without escaping regex metacharacters.
Affected Packages / Versions
• Package: npm `openclaw`
• Affected versions: `<= 2026.2.17`
• First affected release: `2026.2.6`
• Patched version: `2026.2.19`
Impact
• ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing.
• Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.
Fix Commit(s)
• `7e67ab75cc2f0e93569d12fecd1411c2961fcc8c`
• `74268489137510b6f6349919d1e197b17290d92c`
Thanks @allsmog for reporting.
Related
Alias · CVE (1)
- CVE-2026-22178 OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-22178 advisory
- https://github.com/openclaw/openclaw/commit/74268489137510b6f6349919d1e197b17290d92c web
- https://github.com/openclaw/openclaw/commit/7e67ab75cc2f0e93569d12fecd1411c2961fcc8c web
- https://github.com/openclaw/openclaw package
- https://www.vulncheck.com/advisories/openclaw-redos-and-regex-injection-via-unescaped-feishu-mention-metadata web