VULNERABILITY INTELLIGENCE

CVE-2026-22178

CVSS score6.5 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-03-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

Weakness classification

  • disclosure@vulncheck.com: CWE-1333

Primary references