CVE-2026-110689 Details

A vulnerability allowing arbitrary code execution has been identified in OpenClaw ClawScan versions through 0.1.6. The issue arises in the Static Scanner component, specifically within the shouldSkipTargetPath function of internal/runner/runner.go. This vulnerability occurs because the scanner skips the __pycache__ directory, which is where the malicious payload is hidden. When the skill is imported, the payload executes without detection, as the scanning tools do not read the bytecode files. The vulnerability requires local exploitation, and the skill can be crafted to bypass ClawScan's security measures.

Users should upgrade to OpenClaw ClawScan version 0.1.7, which addresses the vulnerability by modifying the static scanner to include Python bytecode files in the analysis. After updating, the same malicious skill would be detected, and the scanner would flag the bytecode as a high-severity issue due to its potential for executing arbitrary code.