CVE-2026-32917: OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP
OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, enabling command execution when remote attachment staging is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32917?
CVE-2026-32917 is classified as a high severity vulnerability due to its potential impact on system security.
How do I fix CVE-2026-32917?
To fix CVE-2026-32917, upgrade OpenClaw to version 2026.3.13 or later where the vulnerability has been patched.
What causes CVE-2026-32917?
CVE-2026-32917 is caused by unsanitized iMessage attachment paths, allowing for remote command injection.
Who is affected by CVE-2026-32917?
CVE-2026-32917 affects all versions of OpenClaw prior to 2026.3.13.
What types of attacks can exploit CVE-2026-32917?
CVE-2026-32917 can be exploited through remote command injection attacks by leveraging unsanitized input in the iMessage attachment staging flow.