8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27001

CVE-2026-27001: OpenClaw: Unsanitized CWD path injection into LLM prompts

Overview

OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contains control/format characters (for example newlines or Unicode bidi/zero-width markers), those characters could break the prompt structure and inject attacker-controlled instructions.

Impact

Prompt injection may alter agent behavior and could lead to unintended tool use or disclosure of sensitive information.

Affected Packages / Versions

Package: openclaw (npm)
Vulnerable versions: < 2026.2.15 (latest published vulnerable version as of 2026-02-16: 2026.2.14)
Patched versions: >= 2026.2.15

Fix

The workspace path is now sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators. Workspace path resolution also applies the same sanitization as defense-in-depth.

Fix Commit(s)

6254e96acf16e70ceccc8f9b2abecee44d606f79

Thanks @aether-ai-agent for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27001

CVE-2026-27001:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.15	2026.2.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a prompt injection issue in OpenClaw, where the current working directory path was not sanitized before being included in an LLM prompt. An attacker who can control the directory name where OpenClaw is executed could use special characters (like newlines) to inject malicious instructions into the system prompt, potentially leading to unintended agent behavior.

The analysis of the fix commit 6254e96acf16e70ceccc8f9b2abecee44d606f79 reveals the vulnerable parts of the code. A new sanitization function, sanitizeForPromptLiteral, was introduced and applied in two key places:

resolveRunWorkspaceDir in src/agents/workspace-run.ts: This function is responsible for resolving the workspace directory path. Before the patch, it would process a user-provided path without any sanitization. The returned workspaceDir could contain malicious characters. The patch introduces a call to the new sanitizeForPromptLiteral function to clean the path.
buildAgentSystemPrompt in src/agents/system-prompt.ts: This function constructs the system prompt for the agent. It was directly embedding the workspaceDir and other path-related strings from sandboxInfo into the prompt. Since these values were not sanitized, it was possible to inject newlines and other control characters, thus altering the prompt's structure and instructions. The patch applies sanitizeForPromptLiteral to all these values before they are included in the prompt.

The identified functions are the ones that either process the malicious input (resolveRunWorkspaceDir) or use it to construct the vulnerable output (buildAgentSystemPrompt). An attacker exploiting this vulnerability would cause these functions to appear in a runtime profile.

Vulnerable functions

buildAgentSystemPrompt

src/agents/system-prompt.ts

The function `buildAgentSystemPrompt` constructs the agent's system prompt. Before the patch, it directly used the `workspaceDir` and other path-like parameters from `sandboxInfo` without sanitization. An attacker-controlled directory name containing special characters could be used to inject malicious instructions into the prompt. The patch adds sanitization using `sanitizeForPromptLiteral`.

resolveRunWorkspaceDir

src/agents/workspace-run.ts

The function `resolveRunWorkspaceDir` resolves the workspace directory path. It took a user-provided path, and after trimming, it was used without sanitization. This unsanitized path was then passed to other parts of the system, including `buildAgentSystemPrompt`. The patch adds a call to `sanitizeForPromptLiteral` to clean the path before it's resolved and returned.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27001: OpenClaw: Unsanitized CWD path injection into LLM prompts

Overview

Impact

Affected Packages / Versions

Fix

Fix Commit(s)

CVE-2026-27001:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

8.6

8.6

Technical Details

CVE-2026-27001: OpenClaw: Unsanitized CWD path injection into LLM prompts

Overview

Impact

Affected Packages / Versions

Fix

Fix Commit(s)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI