CVE-2026-91835

LowCVSS 2.8

Published: 15/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

2th percentile - higher than 2% of all known CVEs

Summary

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6 in the IsBinaryFile function of internal/runner/static_scanner.go in the File Classifier component. The manipulation results in interpretation conflict, and local access is required. The exploit is now public and may be used.

Risk Assessment

A local attacker can use the public exploit to misclassify binary files, potentially leading to missed or incorrect threat analysis by the scanner.

Recommendation

Upgrade OpenClaw ClawScan to version 0.1.7 (patch 04401337b3adb9343bd338b21e5e258bf49ca9c8) to resolve the issue.

Other vulnerabilities in OpenClaw ClawScan

CVE-2026-91836Low
A flaw has been found in OpenClaw ClawScan up to 0.1.6 in an unknown function of internal/runner/static_scanner.go in the Static Scanner component. The manipulation causes incomplete comparison with missing factors, and the attack can be launched locally. The exploit has been published and may be used.

Original NVD description (English source)

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS