Loading vulnerability…
Remote Command Injection in OpenClaw iMessage Attachment Staging
CVE-2026-32917 is a remote command injection vulnerability affecting OpenClaw versions before 2026.3.13. The flaw is in the iMessage attachment staging flow, where unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without proper validation or sanitization. When remote attachment staging is enabled, an attacker can supply a crafted attachment path that causes arbitrary shell commands to be executed on configured remote hosts.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary command execution on configured remote hosts involved in the attachment staging workflow. This can result in full compromise of confidentiality, integrity, and availability on those hosts, including unauthorized access to data, modification or destruction of files, installation of additional payloads, and service disruption.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable remote attachment staging to remove the vulnerable execution path. Restrict or isolate configured remote hosts used for staging, minimize shell access and privileges for the account performing SCP operations, and apply strict input validation to attachment path values to reject shell metacharacters and other unsafe characters. Monitoring for anomalous SCP invocations and unexpected command execution on staging hosts may help detect exploitation attempts.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.3.13 or later, which contains the fix for this issue. Review the fixing commit a54bf71b4c0cbe554a84340b773df37ee8e959de and associated advisory GHSA-g2f6-pwvx-r275 to ensure the patched handling of remote attachment paths is deployed. Validate that all code paths invoking SCP with user-controllable path components properly sanitize or avoid shell-interpreted operands.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.