Root cause
Injection & unsafe execution introduced
The imported plugin removed incoming mentions with a regular expression built from the raw mention name and key, so message metadata became pattern syntax rather than literal text.
The imported Feishu plugin compiled message mention metadata straight into regular expressions, so a crafted mention name could either stall message processing with catastrophic backtracking or quietly delete message text that the sender never wrote as a pattern.
How AI contributed: Direct introductionPublished Mar 2, 2026 in 
openclaw/openclawAll 35 findings in this repository
Show full advisory descriptionHide advisory description
Inbound Feishu messages carry a mention list alongside the text, and the plugin removed each mention from the body before handing the result to the agent. That removal built a regular expression directly from the mention name and from the mention key, with no escaping, so anything a sender could place in that metadata became part of the pattern. Two consequences follow. A name shaped as a nested quantifier turns a single message into exponential backtracking and blocks the channel while it runs, and a name shaped as a pattern fragment changes which parts of the message are deleted before the model sees them. The fix escapes metacharacters in both values before the pattern is compiled, and the neighbouring mention helper in the same plugin already applied that escaping, so the safe form was present in the extension all along.
What actually happenedHide details
The mention-stripping helper turned every mention name and mention key into a regular expression source string instead of matching them as literal text, so metacharacters carried by that metadata were executed as pattern syntax: a nested-quantifier name makes each non-matching message backtrack exponentially, and an injected anchor or alternation removes content that was never meant to be stripped.
Fix
Security fix
The helper escapes regular-expression metacharacters in both the mention name and the mention key before compiling the pattern, matching the escaping the neighbouring mention helper already used.
Fix by Jamie, Peter Steinberger · no AI marker found
Case facts
- CVE ID
- CVE-2026-22178
- GHSA ID
- GHSA-C6HR-W26Q-C636
- Published
- Mar 2, 2026
- Severity
- Not scored
- Language
- TypeScript
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- v2026.2.6
- Fixed release
- v2026.2.19
AI-assisted change
AI-assisted changeextensions/feishu/src/bot.tssource openclaw/openclaw@2267d58afc+12−0
--- /dev/null+++ b/extensions/feishu/src/bot.ts@@ -0,0 +1,823 @@+function stripBotMention(+ text: string,+ mentions?: FeishuMessageEvent["message"]["mentions"],+): string {Show 8 hidden lines
+ if (!mentions || mentions.length === 0) return text;+ let result = text;+ for (const mention of mentions) {+ result = result.replace(new RegExp(`@${mention.name}\\s*`, "g"), "").trim();+ result = result.replace(new RegExp(mention.key, "g"), "").trim();+ }+ return result;+}The imported plugin builds the mention-stripping pattern from the mention name and the mention key themselves, and its caller runs that helper on every inbound message, so sender-controlled metadata becomes pattern syntax.
Security fix
Fixextensions/feishu/src/bot.tssource openclaw/openclaw@7e67ab75cc+6−2
@@ -199,6 +199,10 @@ function checkBotMentioned(event: FeishuMessageEvent, botOpenId?: string): boole return false; } +function escapeRegExp(s: string): string {+ return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");+}+Show 14 hidden lines
function stripBotMention( text: string, mentions?: FeishuMessageEvent["message"]["mentions"],@@ -206,8 +210,8 @@ function stripBotMention( if (!mentions || mentions.length === 0) return text; let result = text; for (const mention of mentions) {- result = result.replace(new RegExp(`@${mention.name}\\s*`, "g"), "").trim();- result = result.replace(new RegExp(mention.key, "g"), "").trim();+ result = result.replace(new RegExp(`@${escapeRegExp(mention.name)}\\s*`, "g"), "").trim();+ result = result.replace(new RegExp(escapeRegExp(mention.key), "g"), "").trim(); } return result; }The fix escapes metacharacters in the mention name and key before the pattern is compiled, so the metadata is matched as literal text and a hostile name can no longer change the pattern or its running time.
Patch fingerprints
AI-assisted change a1506eaa9222d1f4769105e59d4b476f89f728796130bc75892d6ee265a95088 · Fix 183173916860df53b2fd2c7fcca540d918ed81aad1bb4f34f80fa587f85596bc