CVE-2026-24763
Command Injection via Skill Configuration Parameters
What this means in plain English
If you install a malicious skill, it can sneak shell commands into configuration values and run them directly on your computer — with full access to everything your user account can do. This is one of the most dangerous classes of vulnerability.
Technical description
Improper sanitization of skill configuration parameters allows an attacker to inject arbitrary shell commands that execute with the permissions of the OpenClaw process.
Affected versions
< 0.12.8
Fixed in: 0.12.8
Details
Are you affected?
Run `openclaw --version`
Versions below 0.12.8 are affected
Check your skill list for recently installed items
How to fix
Update immediately: `npm update -g openclaw`
Review all installed skills for suspicious configuration
Scan each skill at GitOpenClaw before reinstalling
Scan your skills for this vulnerability
Use GitOpenClaw to scan any skill, repo, or install command for patterns associated with CVE-2026-24763 and other known vulnerabilities. Free, no account required.
References
- https://cisco.com/security/advisories/openclaw-2026-24763