- The Mess: OpenClaw before 2026.3.13 allowed attacker-controlled iMessage attachment paths to reach an
scpcommand without proper sanitization. Shell metacharacters could therefore turn a filename into a command-execution primitive on the configured remote host. - The Damage: With remote iMessage attachment staging enabled, an attacker could potentially execute arbitrary commands on the remote machine handling those attachments. The flaw carries a CVSS 4.0 score of 9.2 — Critical from VulnCheck.
- The Fix: Upgrade OpenClaw to 2026.3.13 or later and disable remote iMessage attachment handling if it isn’t required.
The filename was supposed to identify an attachment.
Instead, it could become part of a shell command.
That’s the entire problem behind CVE-2026-32917.
And because OpenClaw is an AI agent sitting between messages and system tools, an ordinary attachment-processing feature suddenly became a potential remote code-execution path.
The Filename Was the Payload
OpenClaw supports remote staging of iMessage attachments.
When enabled, the application uses scp to move an attachment from a configured remote host.
The vulnerable versions trusted the remote attachment path too much.
A specially crafted filename containing shell metacharacters could reach the SCP remote operand without adequate validation.
The attacker doesn’t need to upload an executable named:
malware.exe
The filename itself can carry the attack.
From iMessage to Shell
The vulnerable chain looks like this:
iMessage → attachment metadata → remote path → SCP → shell interpretation → command execution
That’s a nasty trust boundary.
The application receives data from an external messaging channel.
That data becomes a filesystem path.
The path becomes part of a command.
And the command reaches another machine.
The vulnerability is classified as CWE-78: OS Command Injection.
The Remote Host Is the Prize
This isn’t simply a local crash.
The vulnerable functionality can execute commands on the configured remote attachment host.
That’s why the impact is much more serious than a malformed filename.
If that remote machine has credentials, network access or access to other internal services, command execution can become the first step toward lateral movement.
The attacker starts with an attachment.
They end up with a shell.
The AI Connection Makes It Worse
OpenClaw isn’t an ordinary image viewer.
It’s an AI-powered agent designed to process messages and interact with external systems.
That means every new integration creates another boundary between:
untrusted content
and
privileged actions.
iMessage is simply one example.
If an agent can receive external content, interpret it and then invoke operating-system functionality, the parser around that content becomes security-critical.
A filename isn’t “just a filename” anymore.
OpenClaw Already Had a Similar Warning Sign
The same iMessage attachment subsystem has had another security issue involving arbitrary file disclosure.
A separate advisory documented how stageSandboxMedia could accept arbitrary absolute paths when remote attachment fetching was enabled, potentially exposing files readable by the OpenClaw process.
That makes the architecture worth watching.
One bug exposed files.
Another turned attachment metadata into command injection.
Different vulnerabilities.
Same general problem:
untrusted attachment data crossing into a privileged operation.
The Fix Is Specific
OpenClaw fixed CVE-2026-32917 in 2026.3.13.
The patched implementation validates the SCP remote path and rejects shell metacharacters before spawning scp. Regression tests were also added specifically for malicious remote attachment filenames.
So the immediate answer is simple:
upgrade.
If remote iMessage attachment staging isn’t needed, disabling it removes the attack path entirely.
Why Defenders Should Care
The CVE received a 9.2 CVSS 4.0 score from VulnCheck, with high impact across confidentiality, integrity and availability. NVD lists the vulnerable range as versions before 2026.3.13.
But the number isn’t the interesting part.
The interesting part is the boundary.
Modern AI agents connect:
- messaging platforms
- files
- shell commands
- APIs
- remote systems
- authentication credentials
Every connection is another place where hostile input can become an instruction.
Bugstoday Opinion
We’ve spent decades teaching developers:
Never put user input directly into a shell command.
Then we built AI agents that process messages, attachments and external content and gave them access to those same commands.
OpenClaw’s iMessage bug is a perfect example of what happens when those worlds collide.
The attacker doesn’t need a fancy exploit chain.
They need a malicious attachment path.
The application turns it into a command.
The remote server executes it.
Bugstoday verdict: when an AI agent can turn messages into system actions, every filename, URL and attachment becomes potentially executable input. Treating it as harmless metadata is how you end up handing an attacker a shell.
Today’s Bugs. Tomorrow’s Breaches.
