What’s Vulnerable › Vulnerabilities

CVE-2026-22178: OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-18 · updated 2026-06-17
• Weakness: CWE-1333

Description

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

Affected products

• OpenClaw: before 2026.2.19 — fixed in 2026.2.19

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.19. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/74268489137510b6f6349919d1e197b17290d92c
• https://github.com/openclaw/openclaw/commit/7e67ab75cc2f0e93569d12fecd1411c2961fcc8c
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636
• https://www.vulncheck.com/advisories/openclaw-redos-and-regex-injection-via-unescaped-feishu-mention-metadata

Get alerted when CVE-2026-22178 or the next vulnerability affects your stack