AI Threat Alert
CVE-2026-100564
MEDIUMOpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled...
Full CISO analysis pending enrichment.
How severe is it?
What is the attack surface?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-100564?
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications.
Is CVE-2026-100564 actively exploited?
No confirmed active exploitation of CVE-2026-100564 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-100564?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-100564?
CVE-2026-100564 has a CVSS v3.1 base score of 5.4 (MEDIUM).
What are the technical details?
Original Advisory
OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications.
Weaknesses (CWE)
CWE-1236 — Improper Neutralization of Formula Elements in a CSV File: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
- [Implementation] When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
- [Implementation] If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N