CVE-2026-110689
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.
| CWE | CWE-693 |
| Vendor | openclaw |
| Product | clawscan |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw clawscan
Be the first to know when new medium vulnerabilities affecting openclaw clawscan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
OpenClaw / ClawScan
0.1.0 0.1.1 0.1.2 0.1.3 0.1.4 0.1.5 0.1.6
References
vuldb.com: https://vuldb.com/vuln/419836 vuldb.com: https://vuldb.com/vuln/419836/cti vuldb.com: https://vuldb.com/cve/CVE-2026-110689 vuldb.com: https://vuldb.com/submit/1003915 github.com: https://github.com/openclaw/clawscan/issues/39 github.com: https://github.com/openclaw/clawscan/pull/41 github.com: https://github.com/nedlir/skills-scanner-bypass github.com: https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa github.com: https://github.com/openclaw/clawscan/releases/tag/v0.1.7 github.com: https://github.com/openclaw/clawscan/
Credits
🔍 nedlir (VulDB User)