Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · OpenClaw

CVE-2026-22178: OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction

mediumCVSS 4.0 6.9GHSA-c6hr-w26q-c636

Summary extensions/feishu/src/bot.ts constructed new RegExp() directly from Feishu mention metadata (mention.name, mention.key) in stripBotMention() without escaping regex metacharacters. Affected Packages / Versions - Package: npm openclaw - Affected versions: <= 2026.2.17 - First affected release: 2026.2.6 - Patched version: 2026.2.19 Impact - ReDoS: crafted nested-quantifier patterns in mention metadata can…

Published Mar 2, 2026 · Updated Mar 19, 2026

Affected packages

openclaw

Ecosystem
npm
Affected
< 2026.2.19
Fixed in
2026.2.19
Check
npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

extensions/feishu/src/bot.ts constructed new RegExp() directly from Feishu mention metadata (mention.name, mention.key) in stripBotMention() without escaping regex metacharacters.

Affected Packages / Versions

  • Package: npm openclaw
  • Affected versions: <= 2026.2.17
  • First affected release: 2026.2.6
  • Patched version: 2026.2.19

Impact

  • ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing.
  • Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.

Fix Commit(s)

  • 7e67ab75cc2f0e93569d12fecd1411c2961fcc8c
  • 74268489137510b6f6349919d1e197b17290d92c

Thanks @allsmog for reporting.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries