7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25157

CVE-2026-25157: OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand

OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25157

CVE-2026-25157:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
clawdbot	npm	< 2026.1.29	2026.1.29

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability consists of two related OS command injection issues in the SSH remote connection handling. The provided patch addresses one of these issues in the TypeScript codebase of the clawdbot npm package.\n\nThe primary vulnerable function is parseSshTarget in src/infra/ssh-tunnel.ts. This function was responsible for parsing an SSH target string but failed to prohibit hostnames starting with a dash (-). This allowed an attacker to craft a malicious SSH target like -oProxyCommand=..., which would be interpreted as a command-line option by the ssh client, leading to local command execution.\n\nThe patch rectifies this by adding a check in parseSshTarget to reject any hostname that begins with a dash.\n\nAdditionally, two other functions, startSshPortForward in src/infra/ssh-tunnel.ts and resolveSshConfig in src/infra/ssh-config.ts, were involved in the execution flow. These functions construct and spawn ssh commands. The patch hardens them by adding the -- argument before the user-supplied host. This ensures that any user input is treated as a positional argument (the hostname) and not as an option, even if it starts with a dash.\n\nThe function gatewayStatusCommand in src/commands/gateway-status.ts is also identified as it is a user-facing command that utilizes the vulnerable parseSshTarget function, making it an entry point for the exploit.\n\nThe vulnerability description also mentions a second vulnerability in a function named sshNodeCommand within a Swift file (CommandResolver.swift). However, the provided patch files do not contain any changes related to this function or file. The analysis is therefore based solely on the evidence present in the provided TypeScript patch, which addresses the SSH target handling vulnerability.

Vulnerable functions

parseSshTarget

src/infra/ssh-tunnel.ts

The function `parseSshTarget` in `src/infra/ssh-tunnel.ts` did not properly validate SSH target strings. An attacker could provide a target starting with a dash (e.g., `-oProxyCommand=...`), which would be interpreted as a command-line option by the `ssh` command instead of a hostname. This allowed for arbitrary command execution on the local machine.

startSshPortForward

src/infra/ssh-tunnel.ts

The function `startSshPortForward` constructs and executes an `ssh` command. Before the patch, it was vulnerable to command injection because it did not properly separate the user-supplied target from the command's options. The patch adds `--` to ensure the target is not interpreted as an option.

resolveSshConfig

src/infra/ssh-config.ts

The function `resolveSshConfig` constructs and executes an `ssh` command to resolve SSH configuration. It was vulnerable to command injection because it did not properly separate the user-supplied target from the command's options. The patch adds `--` to ensure the target is not interpreted as an option.

gatewayStatusCommand

src/commands/gateway-status.ts

The `gatewayStatusCommand` function is an entry point that processes SSH targets. It uses the vulnerable `parseSshTarget` function to validate candidates for SSH targets, making it part of the attack surface for the command injection vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.