OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

Summary

When the Slack integration is enabled, Slack channel metadata (topic/description) could be incorporated into the model's system prompt.

Impact

Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadata to be treated as higher-trust system input.

This is relevant only for deployments that enable Slack. In deployments where tool execution is enabled, a successful injection could lead to unintended tool invocations and/or unintended data exposure.

Affected Packages / Versions

• npm: openclaw < 2026.2.3

Patched Versions

• npm: openclaw >= 2026.2.3

Mitigation

• If you do not use Slack: no action required.
• If you use Slack: upgrade to a patched version.

Fix Commit(s)

• 35eb40a7000b59085e9c638a80fd03917c7a095e

Thanks @KonstantinMirin for reporting.