OpenClaw has a command injection in maintainer clawtributors updater

OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script `scripts/update-clawtributors.ts`. The issue affects contributors/maintainers (or CI) who run `bun scripts/update-clawtributors.ts` in a source checkout that contains a malicious commit author email (e.g. crafted `@users[.]noreply[.]github[.]com` values). Normal CLI usage is not affected (`npm i -g openclaw`): this script is not part of the shipped CLI and is not executed during routine operation. The script derived a GitHub login from `git log` author metadata and interpolated it into a shell command (via `execSync`). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run. Version 2026.2.14 contains a patch.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

OpenClaw 操作系统命令注入漏洞

OpenClaw是openclaw开源的一个智能人工助理。 OpenClaw 2026.1.8版本至2026.2.13版本存在操作系统命令注入漏洞，该漏洞源于维护者/开发脚本scripts/update-clawtributors.ts中存在命令注入，当运行包含恶意提交作者电子邮件的脚本时，可能导致执行任意命令。

N/A

N/A