CVE-2026-91835 in ClawScan
Summary
by MITRE • 09/15/2026
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in OpenClaw ClawScan versions up to 0.1.6 centers on a critical logic error within the File Classifier component, specifically affecting the IsBinaryFile function located in internal/runner/static_scanner.go. This flaw represents an interpretation conflict where the scanner fails to correctly distinguish between binary and text-based file formats during static analysis operations. The core technical issue stems from inadequate validation or ambiguous heuristics used by the scanning engine when evaluating file headers, magic numbers, or content patterns. Such misclassification can lead the system to apply incorrect processing rules, potentially causing false positives in security alerts or allowing malicious payloads disguised as benign files to bypass detection mechanisms entirely. This type of defect is commonly categorized under CWE-20 Improper Input Validation and aligns with ATT&CK technique T1564 Hidden Files and Directories if exploited for evasion purposes.
The operational impact of this vulnerability is significant because it undermines the integrity of the static scanning process which serves as a primary defense layer against malware, ransomware, and other malicious artifacts. When an attacker can manipulate file inputs to trigger misinterpretation by IsBinaryFile they may successfully evade detection systems that rely on accurate classification for subsequent analysis steps such as signature matching or behavioral monitoring. Although local access is required to exploit this flaw limiting the attack surface compared to remote code execution vulnerabilities it remains dangerous in environments where untrusted files are processed locally including development workstations, CI/CD pipelines running static scans and endpoint protection agents performing file inspections. The availability of public exploits further increases risk by lowering the barrier for adversaries who may leverage known techniques to bypass security controls without needing custom tooling or advanced reverse engineering skills.
Mitigation strategies must prioritize immediate remediation through software updates as vendor guidance indicates that upgrading OpenClaw ClawScan to version 0.1.7 resolves the underlying logic error in static scanner implementation. The patch identified by commit hash 04401337b3adb9343bd338b21e5e258bf49ca9c8 addresses the root cause of interpretation conflicts ensuring consistent and accurate file classification across all supported input types organizations should verify deployment status using configuration management tools to confirm version compliance. In addition to patching implementing defense-in-depth measures such as enforcing strict allowlists for executable files deploying advanced endpoint detection with behavioral analysis capabilities and restricting local execution privileges can reduce exposure even if similar vulnerabilities emerge in future releases regular auditing of file handling routines against industry standards like CWE-20 helps maintain robust security posture over time.