This article published on 23rd Sep 2026

NVD Published: 20th Sep 2026

Preface: If you are developing a permanent fix or maintaining a safe deployment, do not patch the dist/ files manually.

Background: OpenClaw acts as a personal orchestrator on your local workstation, handling everything from a user message to tool execution and cloud/local LLM interaction.

About CVE-2026-94094 – Here is the detailed breakdown of how this happens based on the stages shown in infographic:

1. The “Large File” Scenario (Natural Trigger)

In the diagram, during Step 5 to Step 7a (Static & Dynamic Routing / Execute Sandbox Tool), the LLM may decide to generate a webpage, data visualization, or large logs to display via the interactive interface (Canvas skill).

• How it happens: If the AI enters a repetitive loop (Step 8: Dynamic Loop Execution), the generated HTML, CSS, JavaScript files, or raw JSON data can quickly grow in size (potentially reaching hundreds of megabytes).
• The impact: When the local route handler (createCanvasHostHandler on the left side of the diagram) tries to load these assets to serve them to the web view, fs[.]readFile() attempts to pull the entire file into memory all at once. This causes the Node[.]js Heap Allocation to spike instantly, leading to an Out-Of-Memory (OOM) crash and a local workstation DoS.

2. The “Special Code” Scenario (Exploit Trigger)

In a security audit context, this risk aligns with path restriction flaws (such as the vulnerabilities involving path traversal in OpenClaw’s Canvas server).

• How it happens: A malicious payload, or an unvetted third-party plugin running in Step 7a, can pass a crafted path traversal string (e.g., using ../../../../ to point to huge system log files, or virtual devices like /dev/urandom that stream infinitely).
• The impact: Because the createCanvasHostHandler lacks file-size checking or stream chunking restrictions, it will naively attempt to buffer the targeted resource, exhausting the workstation’s RAM and CPU instantly.

Vulnerability details: CVE-2026-94094      A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server[.]ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion’s “streaming/size-limit” was never shipped – latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve[.]runtime[.]ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-94094