AI agent vulnerability · OpenClaw

CVE-2026-35651: OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

mediumCVSS 4.0 5.3 · 3.1 4.3GHSA-4hmj-39m8-jwc7

Summary ACP CLI approval prompt ANSI escape sequence injection Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.2.13, <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal…

Published Mar 29, 2026 · Updated Apr 24, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: >= 2026.2.13, <= 2026.3.24
Fixed in: 2026.3.28
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

ACP CLI approval prompt ANSI escape sequence injection

Affected Packages / Versions

Package: openclaw
Affected versions: >= 2026.2.13, <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal output. Commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60 sanitizes tool titles at the source and broadens ANSI stripping to full CSI sequences.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 464e2c10a5edceb380d815adb6ff56e1a4c50f60.

Fix Commit(s)

464e2c10a5edceb380d815adb6ff56e1a4c50f60

Credited to nexrin, KeenSecurityLab, qclawer, anlakii, simon-reisinger-dynatrace.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries