CVE-2026-91835
LowCVSS 2.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6 in the IsBinaryFile function of internal/runner/static_scanner.go in the File Classifier component. The manipulation results in interpretation conflict, and local access is required. The exploit is now public and may be used.
Risk Assessment
A local attacker can use the public exploit to misclassify binary files, potentially leading to missed or incorrect threat analysis by the scanner.
Recommendation
Upgrade OpenClaw ClawScan to version 0.1.7 (patch 04401337b3adb9343bd338b21e5e258bf49ca9c8) to resolve the issue.
Other vulnerabilities in OpenClaw ClawScan
See all- CVE-2026-110689Medium
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6 affecting the function shouldSkipTargetPath in internal/runner/runner.go of the Static Scanner component. Manipulation results in protection mechanism failure. The attack requires local access and the exploit has been publicly released.
- CVE-2026-91836Low
A flaw has been found in OpenClaw ClawScan up to 0.1.6 in an unknown function of internal/runner/static_scanner.go in the Static Scanner component. The manipulation causes incomplete comparison with missing factors, and the attack can be launched locally. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS