Most recent entries from all

bdu:2026-05064

BREW-openclaw-cli-CVE-2026-22178 — OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction

Affected: Homebrew: openclaw-cli

## Summary

`extensions/feishu/src/bot.ts` constructed `new RegExp()` directly from Feishu mention metadata (`mention.name`, `mention.key`) in `stripBotMention()` without escaping regex metacharacters.

## Affected Packages / Versions

- Package: npm `openclaw` - Affected versions: `<= 2026.2.17` - First affected release: `2026.2.6` - Patched version: `2026.2.19`

## Impact

- ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing. - Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.

## Fix Commit(s)

- `7e67ab75cc2f0e93569d12fecd1411c2961fcc8c` - `74268489137510b6f6349919d1e197b17290d92c`

Thanks @allsmog for reporting.

cnvd-2026-15152

EUVD-2026-329361

fkie_cve-2026-22178

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

GHSA-c6hr-w26q-c636 — OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction

Affected: npm: openclaw