Improper Neutralization of Formula Elements in a CSV File in OpenClaw - CVE-2026-100563
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote attacker to inject spreadsheet formulas into Usage CSV exports, potentially disclosing information or modifying spreadsheet data when an operator opens the export.
The vulnerability exists due to improper neutralization of formula-leading characters in the OpenClaw Control UI Usage CSV export when exporting session labels. A remote attacker can influence a session label or first user message to insert a formula-like cell that is evaluated with the spreadsheet user's permissions when an operator opens the export in spreadsheet software with formula evaluation enabled.
OpenClaw does not evaluate the formulas itself; practical impact depends on the spreadsheet application's security settings and formula support.