CVE-2026-91835: OpenClaw file classifier conflict

CISO Take

CVE-2026-91835 is a low-severity interpretation conflict (CWE-436) in the IsBinaryFile function of OpenClaw ClawScan's static scanner, a tool that scans AI agent artifacts. The file classifier can disagree with other components about whether a file is binary, so a crafted file may be treated differently by the scanner than by the agent or tool that later consumes it, which could let content slip past static analysis. Exposure is limited: it needs local access, low privileges and user interaction, the CVSS score is 2.8, it is not in CISA KEV, and the SSVC decision is Track*. The EPSS score of 0.0016 is tiny, even though the supplied percentile figure is high, and no public exploit or Nuclei template is confirmed in our data (NVD text says an exploit is public). Upgrade ClawScan to 0.1.7 (commit 04401337) and re-scan any artifacts that were previously passed as clean, since a scanner bypass weakens the control you rely on to vet agent skills.

Sources:NVDEPSSATLASGitHub (openclaw/clawscan)VulDB

What is the risk?

Low overall (CVSS 3.1: 2.8). The attack needs local access, low privileges and user interaction, and the impact is limited to low integrity (C:N/I:L/A:N). The EPSS score is 0.0016, the CVE is not in CISA KEV, and the SSVC decision is Track*. The NVD description states a public exploit exists, but our enrichment data does not confirm one. The practical risk is indirect: a security scanner that misclassifies files can give false assurance for AI agent artifacts it was meant to vet. Package risk data is unavailable (OpenSSF N/A, dependents unknown), so blast radius is uncertain but likely small.

How does the attack unfold?

Initial Access

Attacker delivers a crafted file inside an agent skill or plugin to a user with local access to the scan workflow.

AML.T0010.005

Defense Evasion

IsBinaryFile misclassifies the file, so ClawScan skips or mishandles its static analysis.

AML.T0074

Impact

The artifact is treated as clean and is loaded by the agent, with low integrity impact on scan results and downstream trust.

AML.T0010.005

Initial Access

Attacker delivers a crafted file inside an agent skill or plugin to a user with local access to the scan workflow.

AML.T0010.005

Defense Evasion

IsBinaryFile misclassifies the file, so ClawScan skips or mishandles its static analysis.

AML.T0074

Impact

The artifact is treated as clean and is loaded by the agent, with low integrity impact on scan results and downstream trust.

AML.T0010.005

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~5d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

2.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRLow

UIRequired

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) Upgrade ClawScan to 0.1.7 or later (patch commit 04401337b3adb9343bd338b21e5e258bf49ca9c8). 2) Re-scan agent skills, plugins and artifacts that were previously cleared by affected versions, particularly files that contain mixed binary and text content or unusual encodings. 3) Do not rely on ClawScan as the only control: add review of third-party agent tools, restrict install sources and run agents with least privilege. 4) Pin the scanner version in CI and track the openclaw/clawscan releases. 5) Treat unexpected classification differences between scanners as a signal to investigate manually.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainAgentPluginAML.T0010.005- AI Agent Tool AML.T0074- Masquerading AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Third-party AI risk policies and procedures

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-91835?

CVE-2026-91835 is a low-severity interpretation conflict (CWE-436) in the IsBinaryFile function of OpenClaw ClawScan's static scanner, a tool that scans AI agent artifacts. The file classifier can disagree with other components about whether a file is binary, so a crafted file may be treated differently by the scanner than by the agent or tool that later consumes it, which could let content slip past static analysis. Exposure is limited: it needs local access, low privileges and user interaction, the CVSS score is 2.8, it is not in CISA KEV, and the SSVC decision is Track*. The EPSS score of 0.0016 is tiny, even though the supplied percentile figure is high, and no public exploit or Nuclei template is confirmed in our data (NVD text says an exploit is public). Upgrade ClawScan to 0.1.7 (commit 04401337) and re-scan any artifacts that were previously passed as clean, since a scanner bypass weakens the control you rely on to vet agent skills.

Is CVE-2026-91835 actively exploited?

No confirmed active exploitation of CVE-2026-91835 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-91835?

1) Upgrade ClawScan to 0.1.7 or later (patch commit 04401337b3adb9343bd338b21e5e258bf49ca9c8). 2) Re-scan agent skills, plugins and artifacts that were previously cleared by affected versions, particularly files that contain mixed binary and text content or unusual encodings. 3) Do not rely on ClawScan as the only control: add review of third-party agent tools, restrict install sources and run agents with least privilege. 4) Pin the scanner version in CI and track the openclaw/clawscan releases. 5) Treat unexpected classification differences between scanners as a signal to investigate manually.

What systems are affected by CVE-2026-91835?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent skill and plugin vetting pipelines, CI/CD security scanning gates, developer workstations running local agents.

What is the CVSS score for CVE-2026-91835?

CVE-2026-91835 has a CVSS v3.1 base score of 2.8 (LOW). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent skill and plugin vetting pipelinesCI/CD security scanning gatesdeveloper workstations running local agents

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0074Masquerading

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.

Exploitation Scenario

An adversary publishes an AI agent skill or plugin containing a file crafted so that ClawScan's IsBinaryFile logic classifies it as binary, while the agent runtime or a downstream tool reads it as text with embedded instructions. A user or CI job runs ClawScan against the package, the file is skipped or not analyzed, and the scan passes. The user then installs the skill, and the hidden content (for example prompt-injection instructions or a malicious script) loads in the agent environment. Exploitation needs local access to the scanned content and user interaction, which keeps the likelihood low.

Weaknesses (CWE)

CWE-436Interpretation ConflictPrimary CWE-436Interpretation Conflict

CWE-436 — Interpretation Conflict: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Source: MITRE CWE corpus.