N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2mc2-g238-722j

GHSA-2mc2-g238-722j: OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

Summary

Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens.

Before the fix:

SCP used StrictHostKeyChecking=accept-new in the remote attachment path.
channels.imessage.remoteHost was not validated as a strict SSH host token.

Impact

In remote iMessage deployments that use SCP attachment fetching, a first-connection MITM/DNS-poisoning scenario could cause the wrong host key to be trusted. Unsafe remote host token values could also alter SCP argument semantics.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version currently affected: 2026.2.17
Vulnerable range (structured field): <= 2026.2.17
Patched version (pre-set for next release): >= 2026.2.19

Fix

The fix hardens remote attachment SSH/SCP handling by:

requiring StrictHostKeyChecking=yes for SCP and SSH tunnel paths,
adding strict remoteHost normalization/validation,
adding -- argument barrier for SCP remote source parsing,
validating channels.imessage.remoteHost in config schema,
rejecting unsafe auto-detected host tokens at runtime.

Fix Commit(s)

Pushed to main: 49d0def6d1e88f002026b1d2a35aa615d48a751a

OpenClaw thanks @allsmog for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2mc2-g238-722j

GHSA-2mc2-g238-722j:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.17	2026.2.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the handling of remote iMessage attachments, which uses SCP and SSH for file transfers. The root cause is twofold. First, the system used an insecure StrictHostKeyChecking=accept-new policy for both SCP (scpFile function) and SSH tunnels (startSshPortForward function). This allows a machine-in-the-middle attacker to intercept the initial connection and have their host key trusted automatically. Second, the remoteHost parameter, which could be set in the configuration or auto-detected from a script, was not validated. This lack of validation, particularly in the monitorIMessageProvider function, allowed a maliciously crafted host string (e.g., containing spaces and extra SSH options) to be passed to the scp command in the scpFile function, leading to an OS command injection vulnerability. The patch addresses these issues by enforcing StrictHostKeyChecking=yes and implementing strict validation and normalization for the remoteHost value.

Vulnerable functions

scpFile

src/auto-reply/reply/stage-sandbox-media.ts

The function constructs and executes an `scp` command. It used the `StrictHostKeyChecking=accept-new` option, making it vulnerable to machine-in-the-middle (MITM) attacks on the first connection. Additionally, it directly concatenated the `remoteHost` parameter into the command arguments without proper sanitization or validation, making it vulnerable to command injection if a malicious `remoteHost` value is passed from the configuration or auto-detection.

startSshPortForward

src/infra/ssh-tunnel.ts

The function initiates an SSH port forwarding tunnel. It used the `StrictHostKeyChecking=accept-new` option, which automatically adds new host keys to the `known_hosts` file. This makes the connection vulnerable to a machine-in-the-middle (MITM) attack if an attacker can intercept the initial connection.

monitorIMessageProvider

src/imessage/monitor/monitor-provider.ts

This function is responsible for determining the `remoteHost` for SCP operations. It would read the `remoteHost` directly from the configuration or attempt to auto-detect it by calling `detectRemoteHostFromCliPath`. In the vulnerable version, it performed no validation on this value before it was used to construct SCP commands in `scpFile`, allowing an unsafe host string to be passed.

detectRemoteHostFromCliPath

src/imessage/monitor/monitor-provider.ts

This function parses a CLI path to find a remote host. The value it extracts was not validated by its caller (`monitorIMessageProvider`) before being used in security-sensitive operations. While the function itself is just parsing, it acts as a source of untrusted data for the command injection vulnerability. The patch adds validation on the output of this function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.