Technical impact
OpenClaw versions before 2026.8.1 do not escape spreadsheet formula characters in participant display names that are exported to CSV. This flaw allows an attacker to embed spreadsheet formulas into the CSV file. When a user opens the file in a spreadsheet application that evaluates formulas, the embedded code is executed with the user's permissions, potentially allowing data exfiltration or execution of unintended actions within the spreadsheet environment.
Affected Systems
Systems affected by this vulnerability include OpenClaw, the attendance and time‑clock management solution. The flaw exists in all releases prior to 2026.8.1; any instance of OpenClaw version 2026.8.0 or earlier is vulnerable.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate risk. No EPSS score is available, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious participant name that is then exported to CSV, and the victim must open the resulting file in a spreadsheet program capable of evaluating formulas. Because the attack surface depends on a user action, the risk to an isolated installation is lower than to a publicly exposed system, but the impact of a successful formula execution can be significant.
