Openclaw cli: OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction (CVE-2026-22178)
Description
OpenClaw CLI versions up to 2026.2.17 are vulnerable to Regular Expression Denial of Service (ReDoS) and regex injection due to unescaped Feishu mention metadata used in RegExp construction. This flaw allows crafted input to cause catastrophic backtracking, blocking message processing, and unintended message content removal. The issue was fixed in version 2026.2.19.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in OpenClaw CLI arises from the construction of new RegExp objects directly from Feishu mention metadata fields (mention.name, mention.key) without escaping regex metacharacters in the stripBotMention() function. This enables attackers to craft nested-quantifier patterns that trigger catastrophic backtracking (ReDoS) and inject regex metacharacters that can remove unintended message content before processing. The affected package is npm openclaw, with versions from 2026.2.6 through 2026.2.17 vulnerable. The issue was patched in version 2026.2.19 via commits 7e67ab75cc2f0e93569d12fecd1411c2961fcc8c and 74268489137510b6f6349919d1e197b17290d92c.
Potential Impact
Attackers can exploit the unescaped regex construction to cause denial of service by triggering catastrophic backtracking, effectively blocking message processing. Additionally, regex injection can lead to removal of unintended message content, potentially affecting the integrity of messages sent to the model.
Mitigation Recommendations
A patch is available and should be applied by upgrading OpenClaw CLI to version 2026.2.19 or later. This update properly escapes regex metacharacters in Feishu mention metadata, mitigating both ReDoS and regex injection risks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-22178
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245d112601ec6a3167fff
Added to database: 10/04/2026, 12:25:53 UTC
Last enriched: 10/04/2026, 13:15:06 UTC
Last updated: 10/04/2026, 16:08:36 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.