CVE-2026-22178

MEDIUM

OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata

Title source: cna
STIX 2.1

Description

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-c6hr-w26q-c636)
https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata
https://www.vulncheck.com/advisories/openclaw-redos-and-regex-injection-via-unescaped-feishu-mention-metadata

Scores

CVSS v3 6.5
EPSS 0.0031
EPSS Percentile 22.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-1333
Status published
Products (4)
npm/openclaw 0 - 2026.2.19npm
OpenClaw/OpenClaw < 2026.2.19
openclaw/openclaw < 2026.2.19
OpenClaw/OpenClaw 2026.2.19
Published Mar 18, 2026
Tracked Since Mar 18, 2026