The vulnerability of the stripBotMention() function in the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a violator to trigger a service denial.

The vulnerability of the stripBotMention function in the AI agent OpenClaw previously known as ClawdBot or MoltBot is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-22178: Inefficient Regular Expression Complexity

OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denial of service. Attackers can craft nested-quantifier patterns or metacharacters in mention metadata to trigger catastroph...