OpenClaw unsanitized current working directory path injection into LLM prompts
OpenClaw contained an unpatched vulnerability (CVE-2026-27001) where directory paths with special characters could be injected into LLM prompts without sanitization, potentially allowing attackers to alter agent behavior or access sensitive information. The vulnerability was patched in version 2026.2.15.
What happened
OpenClaw embedded the current working directory path into the agent system prompt without sanitization. If an attacker could cause OpenClaw to run inside a directory whose name contains control characters, format characters such as newlines or Unicode bidi/zero-width markers, those characters could break the prompt structure and inject attacker-controlled instructions.
Reported impact
Prompt injection could alter agent behavior and lead to unintended tool use or disclosure of sensitive information.
Index analysis
The vulnerability (CWE-77) stemmed from the product constructing LLM prompts using externally-influenced input from the workspace path without proper neutralization of special elements. The fix sanitized the workspace path by stripping Unicode control and format characters, line and paragraph separators before embedding it into any LLM prompt output, with the same sanitization applied to workspace path resolution as defense-in-depth.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.