Em resumo
- CVE-2026-22178 é uma vulnerabilidade ALTO (CVSS 8.2) que afeta openclaw (openclaw), openclaw.
- Chance de exploração nos próximos 30 dias (EPSS): 0.32%, maior que 25.4% das vulnerabilidades.
- Correção: atualize para 2026.2.19 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.19
| 2026.2.19
|
| openclaw npm | < 2026.2.19
| 2026.2.19
|
Description
Summary
extensions/feishu/src/bot.ts constructed new RegExp() directly from Feishu mention metadata (mention.name, mention.key) in stripBotMention() without escaping regex metacharacters.
Affected Packages / Versions
- Package: npm
openclaw
- Affected versions:
<= 2026.2.17
- First affected release:
2026.2.6
- Patched version:
2026.2.19
Impact
- ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing.
- Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.
Fix Commit(s)
7e67ab75cc2f0e93569d12fecd1411c2961fcc8c74268489137510b6f6349919d1e197b17290d92c
Thanks @allsmog for reporting.
NVD description
OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free