CVE-2026-91836

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91836
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91836.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91836
Published
2026-09-15T14:45:11Z
Modified
2026-09-18T03:30:24Z
Severity
  • 0.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors
Details

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1023"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91836.json"
}
References

Affected packages

Git / github.com/openclaw/clawscan

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/clawscan
Events
Introduced
f01dc60afeceea57fa655ec49758f7df91eee3a3
Fixed
9f6a6fbb9f1137345566d0ab44c73893dfe112fa
Fixed
6432c40f23404595f4203f1762ae07d67c481067
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "last_affected": "0.1.0"
        },
        {
            "introduced": "0.1.1"
        },
        {
            "last_affected": "0.1.1"
        },
        {
            "introduced": "0.1.2"
        },
        {
            "last_affected": "0.1.2"
        },
        {
            "introduced": "0.1.3"
        },
        {
            "last_affected": "0.1.3"
        },
        {
            "introduced": "0.1.4"
        },
        {
            "last_affected": "0.1.4"
        },
        {
            "introduced": "0.1.5"
        },
        {
            "last_affected": "0.1.5"
        },
        {
            "introduced": "0.1.6"
        },
        {
            "last_affected": "0.1.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91836.json"