Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for ClawScan by OpenClaw
CVE-2026-91836 (GCVE-0-2026-91836)
Vulnerability from nvd – Published: 2026-09-15 14:45 – Updated: 2026-09-15 14:45 X_Open Source
VLAI
EPSS
VEX
Title
OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors
Summary
A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.
Severity
CWE
- CWE-1023 - Incomplete Comparison with Missing Factors
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/404072 | vdb-entry |
| https://vuldb.com/vuln/404072/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-91836 | third-party-advisory |
| https://vuldb.com/submit/933533 | third-party-advisory |
| https://github.com/openclaw/clawscan/issues/40 | exploitissue-tracking |
| https://github.com/openclaw/clawscan/pull/41 | issue-trackingpatch |
| https://github.com/openclaw/clawscan/commit/9f6a6… | patch |
| https://github.com/openclaw/clawscan/releases/tag… | patch |
| https://github.com/openclaw/clawscan/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openclaw:clawscan:*:*:*:*:*:*:*:*"
],
"modules": [
"Static Scanner"
],
"product": "ClawScan",
"vendor": "OpenClaw",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "unaffected",
"version": "0.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nedlir (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1023",
"description": "Incomplete Comparison with Missing Factors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:45:11.105Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-404072 | OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/404072"
},
{
"name": "VDB-404072 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/404072/cti"
},
{
"name": "CVE-2026-91836 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-91836"
},
{
"name": "Submit #933533 | OpenClaw ClawScan v0.1.6 Incomplete Comparison with Missing Factors",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933533"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/openclaw/clawscan/issues/40"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/openclaw/clawscan/pull/41"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/releases/tag/v0.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/openclaw/clawscan/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-15T10:31:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-91836",
"datePublished": "2026-09-15T14:45:11.105Z",
"dateReserved": "2026-09-15T08:26:33.436Z",
"dateUpdated": "2026-09-15T14:45:11.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91835 (GCVE-0-2026-91835)
Vulnerability from nvd – Published: 2026-09-15 14:15 – Updated: 2026-09-15 14:49 X_Open Source
VLAI
EPSS
VEX
Title
OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict
Summary
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:49 UTC
CWE
- CWE-436 - Interpretation Conflict
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/404071 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/404071/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-91835 | third-party-advisory |
| https://vuldb.com/submit/933532 | third-party-advisory |
| https://github.com/openclaw/clawscan/issues/42 | exploitissue-tracking |
| https://github.com/openclaw/clawscan/pull/43 | issue-trackingpatch |
| https://github.com/openclaw/clawscan/commit/04401… | patch |
| https://github.com/openclaw/clawscan/releases/tag… | patch |
| https://github.com/openclaw/clawscan/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91835",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:49:10.330518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:49:20.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openclaw:clawscan:*:*:*:*:*:*:*:*"
],
"modules": [
"File Classifier"
],
"product": "ClawScan",
"vendor": "OpenClaw",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "unaffected",
"version": "0.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nedlir (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:15:12.767Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-404071 | OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/404071"
},
{
"name": "VDB-404071 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/404071/cti"
},
{
"name": "CVE-2026-91835 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-91835"
},
{
"name": "Submit #933532 | OpenClaw ClawScan v0.1.6 Interpretation Conflict",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933532"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/openclaw/clawscan/issues/42"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/openclaw/clawscan/pull/43"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/commit/04401337b3adb9343bd338b21e5e258bf49ca9c8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/releases/tag/v0.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/openclaw/clawscan/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-15T10:31:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-91835",
"datePublished": "2026-09-15T14:15:12.767Z",
"dateReserved": "2026-09-15T08:26:29.046Z",
"dateUpdated": "2026-09-15T14:49:20.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91836 (GCVE-0-2026-91836)
Vulnerability from cvelistv5 – Published: 2026-09-15 14:45 – Updated: 2026-09-15 14:45 X_Open Source
VLAI
EPSS
VEX
Title
OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors
Summary
A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.
Severity
CWE
- CWE-1023 - Incomplete Comparison with Missing Factors
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/404072 | vdb-entry |
| https://vuldb.com/vuln/404072/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-91836 | third-party-advisory |
| https://vuldb.com/submit/933533 | third-party-advisory |
| https://github.com/openclaw/clawscan/issues/40 | exploitissue-tracking |
| https://github.com/openclaw/clawscan/pull/41 | issue-trackingpatch |
| https://github.com/openclaw/clawscan/commit/9f6a6… | patch |
| https://github.com/openclaw/clawscan/releases/tag… | patch |
| https://github.com/openclaw/clawscan/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openclaw:clawscan:*:*:*:*:*:*:*:*"
],
"modules": [
"Static Scanner"
],
"product": "ClawScan",
"vendor": "OpenClaw",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "unaffected",
"version": "0.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nedlir (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version 0.1.7 mitigates this issue. Patch name: 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1023",
"description": "Incomplete Comparison with Missing Factors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:45:11.105Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-404072 | OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/404072"
},
{
"name": "VDB-404072 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/404072/cti"
},
{
"name": "CVE-2026-91836 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-91836"
},
{
"name": "Submit #933533 | OpenClaw ClawScan v0.1.6 Incomplete Comparison with Missing Factors",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933533"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/openclaw/clawscan/issues/40"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/openclaw/clawscan/pull/41"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/releases/tag/v0.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/openclaw/clawscan/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-15T10:31:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-91836",
"datePublished": "2026-09-15T14:45:11.105Z",
"dateReserved": "2026-09-15T08:26:33.436Z",
"dateUpdated": "2026-09-15T14:45:11.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91835 (GCVE-0-2026-91835)
Vulnerability from cvelistv5 – Published: 2026-09-15 14:15 – Updated: 2026-09-15 14:49 X_Open Source
VLAI
EPSS
VEX
Title
OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict
Summary
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:49 UTC
CWE
- CWE-436 - Interpretation Conflict
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/404071 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/404071/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-91835 | third-party-advisory |
| https://vuldb.com/submit/933532 | third-party-advisory |
| https://github.com/openclaw/clawscan/issues/42 | exploitissue-tracking |
| https://github.com/openclaw/clawscan/pull/43 | issue-trackingpatch |
| https://github.com/openclaw/clawscan/commit/04401… | patch |
| https://github.com/openclaw/clawscan/releases/tag… | patch |
| https://github.com/openclaw/clawscan/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91835",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:49:10.330518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:49:20.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openclaw:clawscan:*:*:*:*:*:*:*:*"
],
"modules": [
"File Classifier"
],
"product": "ClawScan",
"vendor": "OpenClaw",
"versions": [
{
"status": "affected",
"version": "0.1.0"
},
{
"status": "affected",
"version": "0.1.1"
},
{
"status": "affected",
"version": "0.1.2"
},
{
"status": "affected",
"version": "0.1.3"
},
{
"status": "affected",
"version": "0.1.4"
},
{
"status": "affected",
"version": "0.1.5"
},
{
"status": "affected",
"version": "0.1.6"
},
{
"status": "unaffected",
"version": "0.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nedlir (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:15:12.767Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-404071 | OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/404071"
},
{
"name": "VDB-404071 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/404071/cti"
},
{
"name": "CVE-2026-91835 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-91835"
},
{
"name": "Submit #933532 | OpenClaw ClawScan v0.1.6 Interpretation Conflict",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933532"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/openclaw/clawscan/issues/42"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/openclaw/clawscan/pull/43"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/commit/04401337b3adb9343bd338b21e5e258bf49ca9c8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/clawscan/releases/tag/v0.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/openclaw/clawscan/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-15T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-15T10:31:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-91835",
"datePublished": "2026-09-15T14:15:12.767Z",
"dateReserved": "2026-09-15T08:26:29.046Z",
"dateUpdated": "2026-09-15T14:49:20.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}