---
id: CVE-2026-100563
title: >-
  OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading
  characters that spreadsheet applications interpret as formulas when the
  Control UI exports session data to CSV
summary: >-
  OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading
  characters that spreadsheet applications interpret as formulas when the
  Control UI exports session data to CSV. Although session labels were quoted as
  CSV text…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-1236
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw < 2026.8.1
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T03:17:03.290'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100563'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-xx9p-hc9w-6p5h
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-csv-formula-injection-via-session-labels
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T03:25:24.686Z'
---

## Overview

OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated with the permissions of the spreadsheet user. OpenClaw itself does not evaluate the formula, and practical impact depends on the spreadsheet application's security settings. The issue is fixed in 2026.8.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.