PT-2026-25440 · Npm · Openclaw

Publicado 2026-03-03 · Atualizado 2026-03-03

OSV

CVSS v4.0

8.6

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

The Lobster extension tool execution path used a Windows shell fallback (shell: true) after spawn failures (EINVAL/ENOENT). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.2.17
• Latest confirmed affected published version: 2026.2.17
• Patched version: 2026.2.19

Technical Details

In affected releases (including v2026.2.17), extensions/lobster/src/lobster-tool.ts retried subprocess launch with shell: true on Windows for EINVAL/ENOENT spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.

Fix Commit(s)

• ba7be018da354ea9f803ed356d20464df0437916

OpenClaw thanks @allsmog for reporting.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

GHSA-7FCC-CW49-XM78

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7fcc-cw49-xm78 · Nota
• https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916 · Nota
• https://osv.dev/vulnerability/GHSA-7fcc-cw49-xm78 · Aviso do Fabricante