https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 09:08:51 +0000 https://db.gcve.eu/vuln/cve-2026-22178 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.</p> https://db.gcve.eu/vuln/cve-2026-22178 https://db.gcve.eu/vuln/ghsa-c6hr-w26q-c636 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>`extensions/feishu/src/bot.ts` constructed `new RegExp()` directly from Feishu mention metadata (`mention.name`, `mention.key`) in `stripBotMention()` without escaping regex metacharacters.</p> <p>## Affected Packages / Versions</p> <p>- Package: npm `openclaw` - Affected versions: `&lt;= 2026.2.17` - First affected release: `2026.2.6` - Patched version: `2026.2.19`</p> <p>## Impact</p> <p>- ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing. - Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.</p> <p>## Fix Commit(s)</p> <p>- `7e67ab75cc2f0e93569d12fecd1411c2961fcc8c` - `74268489137510b6f6349919d1e197b17290d92c`</p> <p>Thanks @allsmog for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>`extensions/feishu/src/bot.ts` constructed `new RegExp()` directly from Feishu mention metadata (`mention.name`, `mention.key`) in `stripBotMention()` without escaping regex metacharacters.</p> <p>## Affected Packages / Versions</p> <p>- Package: npm `openclaw` - Affected versions: `&lt;= 2026.2.17` - First affected release: `2026.2.6` - Patched version: `2026.2.19`</p> <p>## Impact</p> <p>- ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing. - Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.</p> <p>## Fix Commit(s)</p> <p>- `7e67ab75cc2f0e93569d12fecd1411c2961fcc8c` - `74268489137510b6f6349919d1e197b17290d92c`</p> <p>Thanks @allsmog for reporting.</p> https://db.gcve.eu/vuln/ghsa-c6hr-w26q-c636