CVE-2026-91835: OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/staticscanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw ClawScanto a version that resolves this vulnerability.Fixed in 0.1.7Patch 04401337b3adb9343bd338b21e5e258bf49ca9c8
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Exploitation requires local access and low-level privileges, so systems where untrusted or insufficiently trusted local users can interact with the affected ClawScan component are the relevant exposure case. User interaction is also required.
Which versions are affected and what fixes the issue?
OpenClaw ClawScan versions up to 0.1.6 are affected. Upgrade to version 0.1.7; the associated patch is 04401337b3adb9343bd338b21e5e258bf49ca9c8.
Is there public exploit activity?
A public exploit is available and may be used. Prioritize the upgrade where local attackers could obtain the required privileges and user interaction.