OpenClaw embedded the current working directory into the agent system prompt without sanitization. Because the directory name could contain control or format characters such as newlines or Unicode bidi/zero‑width markers, an attacker that can control the directory name can break the prompt structure and insert attacker‑controlled instructions. This form of flaw is an Input Injection (CWE‑77) that threatens the confidentiality and integrity of the AI assistant’s behavior, potentially allowing an attacker to direct the LLM to perform unintended actions.

The vulnerability affects the OpenClaw personal AI assistant software before version 2026.2.15. All releases that embed the workspace path unsanitized are impacted. The affected platform is Node.js based, as indicated by the product metadata.

The CVSS base score of 8.6 classifies the flaw as high severity. The EPSS score is less than 1 %, implying a low likelihood of exploitation at the moment, and it is not listed in the CISA KEV catalog. The attack vector is inferred to require an attacker who can influence the working directory of the running OpenClaw process—typically a local or privileged user. If the attacker can induce the assistant to operate in a directory with crafted names, the unsanitized path will flow into the prompt and allow injection. No additional external access requirements are indicated in the description, so the main risk is local.