CVE-2026-32013

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that detects the installed version of OpenClaw and compares it against a known secure version to report vulnerability status. It does not exploit any vulnerability; it only checks the version and displays static CVE information.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single bash script (cve-scan.sh) that acts as a version scanner and informational reporter for OpenClaw CVEs. It detects the installed OpenClaw version, compares it against a hardcoded latest secure version, and displays pre-written CVE descriptions and statistics. No backdoor, concealed executable behavior, or operator-directed harm is present. The script does not download, execute, or install any payload; it only reads local version information and prints text to stdout.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesbash
Target softwareOpenClaw
Attack typesnone
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to check the version of OpenClaw and report whether it is vulnerable based on a hardcoded comparison. It does not contain any code to exploit a vulnerability, such as sending malicious payloads, triggering command injection, or performing unauthorized actions. It only detects and reports exposure, which is characteristic of a scanner.

hargabyte-cve-scanner-ba936e9/cve-scan.sh:1-420

Requirements

  • OpenClaw must be installed and accessible in the system PATH for automatic version detection.hargabyte-cve-scanner-ba936e9/cve-scan.sh:58-66

Observed behavior

  • Detects the installed OpenClaw version by executing 'openclaw --version'.hargabyte-cve-scanner-ba936e9/cve-scan.sh:58-66
  • Compares the detected version against a hardcoded latest secure version (v2026.3.1) to determine if the installation is vulnerable.hargabyte-cve-scanner-ba936e9/cve-scan.sh:124-133
  • Displays a static list of CVE identifiers and descriptions, along with general statistics about OpenClaw vulnerabilities.hargabyte-cve-scanner-ba936e9/cve-scan.sh:153-189
  • Outputs a recommendation to update OpenClaw if the version is found to be vulnerable.hargabyte-cve-scanner-ba936e9/cve-scan.sh:247-252
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Script Purpose
OpenClaw CVE version scanner and reporterThe script's sole function is to check the local OpenClaw version and display vulnerability information. It contains no network calls, file writes, or process execution beyond reading the OpenClaw version.hargabyte-cve-scanner-ba936e9/cve-scan.sh:1-420
Hardcoded Urls
https://redpacketsecurity.com/cve-alert-cve-2026-32048-openclaw-openclaw/, https://redpacketsecurity.com/cve-alert-cve-2026-32049-openclaw-openclaw/, https://redpacketsecurity.com/cve-alert-cve-2026-32056-openclaw-openclaw/These URLs appear only in the generated report text and are not fetched or used by the script. They are informational references.hargabyte-cve-scanner-ba936e9/cve-scan.sh:355-357
Review boundaries

What the analysis did not establish

  • The evidence packet contains only one text file (cve-scan.sh) out of 9 total files in the artifact. The other 8 files are unclassified and their content is not provided, so the analysis is based solely on the supplied script.
  • The script's vulnerability database is referenced as a separate JSON file (vulnerability-db.json) which is not included in the evidence, so the completeness of its CVE data cannot be verified.
  • Only the single text file cve-scan.sh was provided; 8 unclassified files totaling 53685 bytes were present in the artifact but not analyzed. Their content is unknown.
  • The review is based solely on static analysis of the supplied text; the script was not executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

13