AI agent vulnerability · OpenClaw

CVE-2026-24764: OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

lowCVSS 3.1 3.7GHSA-782p-5fr5-7fj8

Summary When the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt. Impact Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input. This is relevant only for deployments that enable Slack.

Published Feb 17, 2026 · Updated Feb 19, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.3
Fixed in: 2026.2.3
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

When the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt.

Impact

Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input.

This is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure.

Affected Packages / Versions

npm: openclaw < 2026.2.3

Patched Versions

npm: openclaw >= 2026.2.3

Mitigation

If you do not use Slack: no action required.
If you use Slack: upgrade to a patched version.

Fix Commit(s)

35eb40a7000b59085e9c638a80fd03917c7a095e

Thanks @KonstantinMirin for reporting.

Credited to KonstantinMirin.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries