Detections
Analytics

SCA: security update for clawdbot (GHSA-q284-4pvr-m585)

high Tenable Self-Hosted Container Security Plugin ID 437428

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection
 vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell
 script without properly escaping the user-supplied project path in an error message. When the cd command
 failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command
 execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings
 could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as
 an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local
 machine. This issue has been patched in version 2026.1.29. (CVE-2026-25157)

See Also

https://github.com/advisories/GHSA-q284-4pvr-m585

Plugin Details

Severity: High

ID: 437428

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 2/3/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.07

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-25157

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/2/2026

Vulnerability Publication Date: 2/2/2026

Reference Information

CVE: CVE-2026-25157

cwe: CWE-78