CVE-2026-28484 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: March 5, 2026
OpenClaw - Command Injection
Published: March 5, 2026Updated: March 5, 2026Remote Exploitable
Overview
OpenClaw < 2026.2.15 contains a command injection caused by improper handling of filenames in git-hooks/pre-commit hook, letting attackers inject git flags to add ignored files, exploit requires attacker to create maliciously-named files.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Attackers can inject git flags to add sensitive ignored files to git history, potentially exposing sensitive information.
Mitigation
Update to version 2026.2.15 or later.
References
- https://github.com/openclaw/openclaw/commit/b88f37762f5b6d7ec0f589eb761815e466e4ef4b
- https://github.com/openclaw/openclaw/commit/ba84b1253967143692166023f9e174c149b6f2ed
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mmpf-jwf4-h3qv
- https://www.vulncheck.com/advisories/openclaw-option-injection-in-pre-commit-hook-via-malicious-filenames
Related Resources
Details
- CVE ID
- CVE-2026-28484
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- command_injection
- Status
- new
CWE
- CWE-77
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H