OpenClaw WhatsApp Flaw: Three GHSA Bugs Turn One Message Into Host RCE
Three GHSA-tracked flaws in OpenClaw's WhatsApp integration let a single message trigger full host code execution; all fixed in version 2026.6.6.
A technical breakdown by researcher Chinmohan Nayak shows how three separate flaws in OpenClaw's WhatsApp integration combined to allow full host compromise from a single incoming message, with no prior foothold required. The core issue is the sandbox bind-mount check, getBlockedReasonForSourcePath(), which only verifies whether a requested mount path is a child of a blocked directory (~/.ssh, ~/.aws, ~/.gnupg) — never the reverse. Mounting a parent directory like /home or /var silently brings every protected child path along with it.
That gap is compounded by two command-injection bugs stemming from an incomplete denylist in the host exec filter, plus the fact that WhatsApp metadata fields — contact names, vCard entries, location labels — are flattened straight into the LLM prompt without the untrusted-content marking applied to fetched web content. The three issues, tracked as GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm (both CVSS 8.8) and GHSA-575v-8hfq-m3mc (8.4), were patched in version 2026.6.6.
For engineers running agent gateways against messaging channels, the case highlights a gap most prompt-injection mitigations miss: structured message metadata is often treated as trusted, while only fetched web content gets wrapped as untrusted input.