CVE-2026-22178

MEDIUM6.9

OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata

Published Mar 18, 2026

Modified 1 months ago

Details

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

References

FIX

https://github.com/openclaw/openclaw/commit/74268489137510b6f6349919d1e197b17290d92c

FIX

https://github.com/openclaw/openclaw/commit/7e67ab75cc2f0e93569d12fecd1411c2961fcc8c

ADVISORY

https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-22178

ADVISORY

https://www.vulncheck.com/advisories/openclaw-redos-and-regex-injection-via-unescaped-feishu-mention-metadata

CVSS Analysis