https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-07T19:47:09.644187+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-22178 BREW-openclaw-cli-CVE-2026-22178 — OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction 2026-10-07T19:47:09.646651+00:00

Affected: Homebrew: openclaw-cli

## Summary

`extensions/feishu/src/bot.ts` constructed `new RegExp()` directly from Feishu mention metadata (`mention.name`, `mention.key`) in `stripBotMention()` without escaping regex metacharacters.

## Affected Packages / Versions

- Package: npm `openclaw` - Affected versions: `<= 2026.2.17` - First affected release: `2026.2.6` - Patched version: `2026.2.19`

## Impact

- ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing. - Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.

## Fix Commit(s)

- `7e67ab75cc2f0e93569d12fecd1411c2961fcc8c` - `74268489137510b6f6349919d1e197b17290d92c`

Thanks @allsmog for reporting.

 https://db.gcve.eu/vuln/cve-2026-22178 CVE-2026-22178 — OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata 2026-10-07T19:47:09.646744+00:00

Affected: OpenClaw

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.