OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

The core of this vulnerability lies in prompt injection. When the Slack integration is active, the metadata associated with Slack channels (specifically the topic and description) can be inadvertently included within the system prompt used by the LLM. This effectively treats untrusted Slack data as higher-trust system input. If tool execution is also enabled within the openclaw deployment, a successful prompt injection attack could lead to the unintended invocation of tools, potentially granting an attacker unauthorized access or control. Furthermore, the injection could expose sensitive data that the LLM has access to, widening the scope of the potential damage. The impact is directly proportional to the sensitivity of the data processed by the LLM and the privileges granted to any tools it can invoke.

Organizations utilizing openclaw with the Slack integration enabled are at risk. This includes those deploying LLM-powered applications that leverage openclaw for Slack connectivity. Specifically, deployments that grant the LLM access to sensitive data or allow it to invoke external tools are at higher risk.

• nodejs / package:

  npm list openclaw

• nodejs / package: Check package.json for openclaw dependency and version. • nodejs / application: Review application code for usage of the openclaw package and Slack integration. • nodejs / application: Monitor application logs for unusual LLM behavior or tool invocations.

1. 2026-02-17Disclosure

   disclosure

1. 已保留2026-01-26
2. 发布日期2026-02-17
3. 修改日期2026-02-19
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-24764 is to upgrade to version 2026.2.3 or later of the openclaw package. This version contains the necessary fixes to prevent Slack channel metadata from being incorporated into the system prompt. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider disabling the Slack integration entirely. As a temporary workaround, carefully sanitize any Slack channel metadata before it is used within the system prompt, though this is not a substitute for upgrading. Monitor LLM input and output for unexpected behavior that could indicate a successful prompt injection attack. After upgrading, confirm the fix by attempting to inject malicious prompts through Slack channel metadata and verifying that they are not incorporated into the system prompt.