Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-10291— Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos

Quick assessment

Affected
Enderfga claw-orchestrator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Claw Orchestrator是Guian Fang个人开发者的一个多智能体编码代理运行时平台。 Claw Orchestrator 3.7.0及之前版本存在安全漏洞，该漏洞源于Session Grep Endpoint组件文件claw-orchestrator/src/embedded-server.ts中函数validateRegex对参数body.pattern的错误操作，可能导致正则表达式复杂度问题。

CVSS 4.3 · Medium EPSS 0.35% · P28

Affected Version Matrix 9

VendorProduct Version RangeStatus
Enderfga claw-orchestrator 3.0 affected
3.1 affected
3.2 affected
3.3 affected
3.4 affected
3.5 affected
3.6 affected
3.7.0 affected
… +1 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10291

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the component Session Grep Endpoint. The manipulation of the argument body.pattern leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgrading to version 3.7.1 is sufficient to resolve this issue. The identifier of the patch is 3f970a974c65a94555c25af9f2796f11315e4584. It is recommended to upgrade the affected component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
Claw Orchestrator 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Claw Orchestrator是Guian Fang个人开发者的一个多智能体编码代理运行时平台。 Claw Orchestrator 3.7.0及之前版本存在安全漏洞，该漏洞源于Session Grep Endpoint组件文件claw-orchestrator/src/embedded-server.ts中函数validateRegex对参数body.pattern的错误操作，可能导致正则表达式复杂度问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Enderfga claw-orchestrator 3.0 cpe:2.3:a:enderfga:claw-orchestrator:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-10291

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-10291

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-10291 (2)

Vendor Pages for CVE-2026-10291 (1)

Other References for CVE-2026-10291 (1)

IV. Related Vulnerabilities

Same product: claw-orchestrator
Same vendor: Enderfga
Same weakness: CWE-1333

V. Comments for CVE-2026-10291

No comments yet

Leave a comment