CVE-2026-24763

{"id": "CVE-2026-24763", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24763", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-04T15:54:31.787823Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "clawdbot", "product": "clawdbot", "versions": [{"status": "affected", "version": "< 2026.1.29"}]}]}], "published": "2026-02-02T23:16:08.593", "references": [{"url": "https://github.com/openclaw/openclaw/commit/771f23d36b95ec2204cc9a0054045f5d8439ea75", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.1.29", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mc68-q9jw-2h3v", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw\u2019s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user able to control environment variables could influence command execution within the container context. This vulnerability is fixed in 2026.1.29."}, {"lang": "es", "value": "OpenClaw (anteriormente Clawdbot) es un asistente de IA personal que ejecutas en tus propios dispositivos. Antes de 2026.1.29, exist\u00eda una vulnerabilidad de inyecci\u00f3n de comandos en el mecanismo de ejecuci\u00f3n de sandbox de Docker de OpenClaw debido a un manejo inseguro de la variable de entorno PATH al construir comandos de shell. Un usuario autenticado capaz de controlar variables de entorno podr\u00eda influir en la ejecuci\u00f3n de comandos dentro del contexto del contenedor. Esta vulnerabilidad est\u00e1 corregida en 2026.1.29."}], "lastModified": "2026-06-17T10:23:33.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "4801AF60-B3F7-4C05-A4A1-F8443F445ACD", "versionEndExcluding": "2026.1.29"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}