CVE-2026-100563: OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
OpenClaw (npm package openclaw) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated with the permissions of the spreadsheet user. OpenClaw itself does not evaluate the formula, and practical impact depends on the spreadsheet application's security settings. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Operators who export Usage data and open the resulting CSV in a spreadsheet application with formula evaluation enabled are exposed. The risk is higher where lower-trust participants can influence session labels or the first user message.
What must happen for exploitation to have an effect?
An attacker must place formula-like content in a controllable session label or first user message, and an operator must export the affected data and open the CSV in a spreadsheet application that evaluates formulas. OpenClaw does not execute the formula itself; evaluation occurs in the spreadsheet application under the spreadsheet user's permissions.
What can be done if upgrading is not immediately possible?
Avoid opening Usage CSV exports in spreadsheet applications with formula evaluation enabled, particularly when exported data may contain input from lower-trust participants. Upgrade to version 2026.8.1 when possible.