CVE-2026-22178: OpenClaw ReDoS — MEDIUM

CISO Take

OpenClaw's stripBotMention function builds a RegExp directly from unescaped Feishu mention metadata, so anyone who can post a message into a chat where the bot listens can embed regex metacharacters or nested-quantifier patterns that trigger catastrophic backtracking. This is a low-privilege, network-reachable, no-user-interaction bug (CVSS 6.5) that can stall the bot's event loop or silently strip more content than intended before it reaches the model — a real availability and integrity concern for anything running OpenClaw as a Feishu-facing agent, though EPSS sits at a low 0.31% (77th percentile) and there is no CISA KEV listing, public exploit, or Nuclei template yet, and CISA's own SSVC call is TRACK rather than urgent action. Only 4 downstream dependents are known, capping blast radius, but this package already carries 426 other CVEs and a 0/100 risk score, signaling a broader pattern worth flagging in vendor risk reviews. Patch to OpenClaw >=2026.2.19, which sanitizes mention metadata before RegExp construction; until then, cap processing time around message preprocessing and monitor for CPU spikes correlated with inbound Feishu traffic.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 6.5) reflecting low-complexity, unauthenticated, network-reachable exploitability offset by limited impact (integrity: low, availability: low, no confidentiality loss). Real-world exploitation likelihood is low today — EPSS 0.31% probability of exploitation in the next 30 days, no CISA KEV entry, no public PoC or Nuclei template, and CISA SSVC recommends TRACK. However, the trivial precondition (any Feishu user who can message the bot) combined with well-understood ReDoS crafting techniques means opportunistic exploitation could emerge quickly. Risk is elevated for deployments where the OpenClaw bot is exposed to untrusted or public Feishu workspaces.

How does the attack unfold?

Initial Access

Attacker posts a message with crafted @mention metadata into a Feishu chat where the OpenClaw bot is present, requiring no authentication to the bot itself.

AML.T0093

Exploitation

stripBotMention builds a RegExp directly from the unescaped, attacker-controlled metadata, and nested-quantifier patterns trigger catastrophic backtracking.

AML.T0034.001

Impact

The bot's message processing hangs or slows (denial of service), or the flawed regex strips unintended content from the message before it reaches the model.

AML.T0029

Initial Access

Attacker posts a message with crafted @mention metadata into a Feishu chat where the OpenClaw bot is present, requiring no authentication to the bot itself.

AML.T0093

Exploitation

stripBotMention builds a RegExp directly from the unescaped, attacker-controlled metadata, and nested-quantifier patterns trigger catastrophic backtracking.

AML.T0034.001

Impact

The bot's message processing hangs or slows (denial of service), or the flawed regex strips unintended content from the message before it reaches the model.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A Low

What should I do?

1 step

Upgrade OpenClaw to version 2026.2.19 or later, which applies the linked patch commits sanitizing Feishu mention metadata before RegExp construction. If immediate upgrade isn't possible, wrap regex construction from user-controlled input with a hard timeout or safe-regex library, reject mention metadata containing nested quantifiers or unescaped regex metacharacters, and rate-limit messages per sender to reduce DoS blast radius. Detection: alert on event-loop lag or sustained high CPU on the OpenClaw process correlated with inbound Feishu webhook traffic, and flag messages where mention metadata falls outside an expected character allowlist.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent Framework AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0093 - Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.5 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-22178?

OpenClaw's stripBotMention function builds a RegExp directly from unescaped Feishu mention metadata, so anyone who can post a message into a chat where the bot listens can embed regex metacharacters or nested-quantifier patterns that trigger catastrophic backtracking. This is a low-privilege, network-reachable, no-user-interaction bug (CVSS 6.5) that can stall the bot's event loop or silently strip more content than intended before it reaches the model — a real availability and integrity concern for anything running OpenClaw as a Feishu-facing agent, though EPSS sits at a low 0.31% (77th percentile) and there is no CISA KEV listing, public exploit, or Nuclei template yet, and CISA's own SSVC call is TRACK rather than urgent action. Only 4 downstream dependents are known, capping blast radius, but this package already carries 426 other CVEs and a 0/100 risk score, signaling a broader pattern worth flagging in vendor risk reviews. Patch to OpenClaw >=2026.2.19, which sanitizes mention metadata before RegExp construction; until then, cap processing time around message preprocessing and monitor for CPU spikes correlated with inbound Feishu traffic.

Is CVE-2026-22178 actively exploited?

No confirmed active exploitation of CVE-2026-22178 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22178?

Upgrade OpenClaw to version 2026.2.19 or later, which applies the linked patch commits sanitizing Feishu mention metadata before RegExp construction. If immediate upgrade isn't possible, wrap regex construction from user-controlled input with a hard timeout or safe-regex library, reject mention metadata containing nested quantifiers or unescaped regex metacharacters, and rate-limit messages per sender to reduce DoS blast radius. Detection: alert on event-loop lag or sustained high CPU on the OpenClaw process correlated with inbound Feishu webhook traffic, and flag messages where mention metadata falls outside an expected character allowlist.

What systems are affected by CVE-2026-22178?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat platform integrations (Feishu/Lark bots), message preprocessing pipelines.

What is the CVSS score for CVE-2026-22178?

CVE-2026-22178 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

agent frameworkschat platform integrations (Feishu/Lark bots)message preprocessing pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0093 Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.5

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastrophic backtracking, block message processing, or remove unintended content before model processing.

Exploitation Scenario

An attacker joins or already has access to a Feishu group/channel where an OpenClaw-powered bot is present — no special privileges or authentication to the bot itself are required. The attacker crafts a message whose @mention metadata contains a nested-quantifier regex pattern designed to induce catastrophic backtracking. When OpenClaw builds a RegExp directly from that unescaped metadata to strip the bot's own mention before forwarding the message for model processing, the regex engine enters exponential-time evaluation, hanging or severely slowing the event loop and denying service to every other user of that bot instance. A subtler variant crafts metacharacters that cause the strip operation to remove more or different text than intended, silently altering the content the LLM ultimately processes.

Weaknesses (CWE)

CWE-1333 Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.