CVE-2026-91835 — LOW (CVSS 2.8)

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is...

Full CISO analysis pending enrichment.

How severe is it?

CVSS 3.1

2.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Local

AC Low

PR Low

UI Required

S Unchanged

C None

I Low

A None

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-91835?

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.

Is CVE-2026-91835 actively exploited?

No confirmed active exploitation of CVE-2026-91835 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-91835?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-91835?

CVE-2026-91835 has a CVSS v3.1 base score of 2.8 (LOW). The EPSS exploitation probability is 0.11%.

What are the technical details?

Original Advisory

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.

Weaknesses (CWE)

CWE-436 Interpretation Conflict Primary CWE-436 Interpretation Conflict

CWE-436 — Interpretation Conflict: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Source: MITRE CWE corpus.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

Timeline

Published

September 15, 2026

Last Modified

September 16, 2026

First Seen