---
id: CVE-2026-110689
title: A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6
summary: >-
  A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This
  impacts the function shouldSkipTargetPath of the file
  internal/runner/runner.go of the component Static Scanner. Performing a
  manipulation results in protection m…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-693
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:17:36.433'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110689'
references:
  - url: 'https://github.com/nedlir/skills-scanner-bypass'
    label: cna@vuldb.com
  - url: 'https://github.com/openclaw/clawscan/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa
    label: cna@vuldb.com
  - url: 'https://github.com/openclaw/clawscan/issues/39'
    label: cna@vuldb.com
  - url: 'https://github.com/openclaw/clawscan/pull/41'
    label: cna@vuldb.com
  - url: 'https://github.com/openclaw/clawscan/releases/tag/v0.1.7'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-110689'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/1003915'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/419836'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/419836/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T21:57:04.823Z'
vendor: OpenClaw
product: ClawScan
affected:
  - ClawScan 0.1.0
  - ClawScan 0.1.1
  - ClawScan 0.1.2
  - ClawScan 0.1.3
  - ClawScan 0.1.4
  - ClawScan 0.1.5
  - ClawScan 0.1.6
---

## Overview

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.