CVE-2026-100563

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100563
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100563.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100563
Aliases
  • GHSA-xx9p-hc9w-6p5h
Published
2026-09-26T02:18:55Z
Modified
2026-09-27T03:48:40Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
Details

OpenClaw (npm package openclaw) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated with the permissions of the spreadsheet user. OpenClaw itself does not evaluate the formula, and practical impact depends on the spreadsheet application's security settings. The issue is fixed in 2026.8.1.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-1236"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100563.json"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea806575e6450e4d1efdfc72c19f04be982a1b9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

Other
release-publish/08987d8f409b-20260717
release-publish/0e9db600595-20260717
release-publish/0e9db6005954-20260717
release-publish/0f7fbfa0039f-20260715
release-publish/10a390ed7fa8-20260802
release-publish/17a1225314cd-1787924262
release-publish/1c80cf86cfd0-1787823217
release-publish/1d2777548d01-20260715
release-publish/2133a924eef0-1787945469
release-publish/21b41efc7bb8-1787818100
release-publish/23d2f664fb75-20260715
release-publish/38fd9ad6e417-1787824804
release-publish/404719374e60-1787933925
release-publish/4074a8b44d89-1787849600
release-publish/45ed68e6ea62-1787220256
release-publish/468054f93c43-1787921799
release-publish/491769bded58-1787929537
release-publish/5090935817e3-1787842724
release-publish/54f70c5d8c04-20260715
release-publish/556a2ee276f0-20260718
release-publish/57fabb2c9c35-1786621048
release-publish/5cb2eee257bc-1787929587
release-publish/5cb2eee257bc-1787929714
release-publish/5dca33a8fb67-20260802
release-publish/62c77b0fb51c-1787927225
release-publish/6ddb9f049fb3-1787938179
release-publish/716f996be8db-1786550775
release-publish/728084497329-20260801
release-publish/73d04395defe-20260717
release-publish/7c9794b5c65c-20260801
release-publish/8371831eba5e-1786610071
release-publish/8858944a81c5-20260717
release-publish/8afa8f339eb6-1787798436
release-publish/9b80f9a8b1df-20260717
release-publish/9bc3c2955500-20260802
release-publish/a33c8a5c0ec6-1787896022
release-publish/a84a915b67bd-1787933964
release-publish/a9ac13b2efd7-20260717
release-publish/abd63c06c2f5-1786646045
release-publish/b3986403ddb9-1787938102
release-publish/bb1a7e506927-20260715
release-publish/bccb649077f0-1787900300
release-publish/c28c279afa37-1787225611
release-publish/c3927271fad7-20260715
release-publish/c96e81375014-1787462685
release-publish/ced50f88e928-20260717
release-publish/d5412d73acfb-1787906286
release-publish/d8b3e1c093f2-20260715
release-publish/d8dd59bf8f60-20260717
release-publish/deffca656500-20260801
release-publish/dfa246e6fd16-20260715
release-publish/e11c566824b1-1787940135
release-publish/eb8c22ed13f9-20260801
release-publish/ebc70fa1b3f6-1787634336
release-publish/f4987deb94b8-1786361493
release-publish/f4f5bb15d46a-20260715
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v1.*
v1.0.4
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v2.*
v2.0.0-beta1
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2026.*
v2026.1.10
v2026.1.11
v2026.1.11-1
v2026.1.11-2
v2026.1.11-3
v2026.1.12
v2026.1.12-2
v2026.1.13
v2026.1.14-1
v2026.1.15
v2026.1.16-2
v2026.1.20
v2026.1.21
v2026.1.22
v2026.1.23
v2026.1.24
v2026.1.24-1
v2026.1.29
v2026.1.30
v2026.1.5
v2026.1.5-1
v2026.1.5-2
v2026.1.5-3
v2026.1.8
v2026.1.9
v2026.2.1
v2026.2.12
v2026.2.13
v2026.2.14
v2026.2.15-beta.1
v2026.2.17
v2026.2.19
v2026.2.19-beta.1
v2026.2.2
v2026.2.21
v2026.2.21-beta.1
v2026.2.22
v2026.2.22-beta.1
v2026.2.23
v2026.2.23-beta.1
v2026.2.24
v2026.2.24-beta.1
v2026.2.25
v2026.2.25-beta.1
v2026.2.26
v2026.2.26-beta.1
v2026.2.3
v2026.2.6
v2026.2.6-1
v2026.2.6-2
v2026.2.6-3
v2026.2.9
v2026.3.1
v2026.3.11
v2026.3.11-beta.1
v2026.3.12
v2026.3.13
v2026.3.13-1
v2026.3.2
v2026.3.2-beta.1
v2026.3.22
v2026.3.22-beta.1
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31
v2026.3.31-beta.1
v2026.3.7
v2026.3.7-beta.1
v2026.3.8
v2026.3.8-beta.1
v2026.4.1
v2026.4.1-beta.1
v2026.4.10
v2026.4.11
v2026.4.11-beta.1
v2026.4.12
v2026.4.12-beta.1
v2026.4.14
v2026.4.14-beta.1
v2026.4.15
v2026.4.15-beta.1
v2026.4.15-beta.2
v2026.4.19-beta.1
v2026.4.19-beta.2
v2026.4.2
v2026.4.5
v2026.4.7
v2026.4.7-1
v2026.4.8
v2026.4.9
v2026.4.9-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100563.json"