PT-2026-26235 · Openclaw+1 · Blobster+2

Tdjackey · CVE-2026-31995 · Publicado 2026-02-19 · Atualizado 2026-03-20

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.21 through 2026.2.17

Description The Lobster extension in OpenClaw contains a command injection issue on Windows systems. This occurs due to the fallback mechanism used when spawning processes fails, specifically when shell: true is enabled. Attackers can inject arbitrary commands through arguments provided to the tool, which are then interpreted by cmd.exe. The issue arises when spawn failures trigger shell fallback with shell set to true, allowing attackers to control workflow arguments and execute malicious commands. The Windows shell fallback has been removed in a later version.

Recommendations Update to OpenClaw version 2026.2.19 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2026-05251

CVE-2026-31995

GHSA-8PX5-2GFR-7PH6

GHSA-FG3M-VHRR-8GJ6

Produtos afetados

Blobster

Openclaw

Windows

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31995.json · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fg3m-vhrr-8gj6 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916 · Correção
• https://osv.dev/vulnerability/GHSA-8px5-2gfr-7ph6 · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/2034735877205729693 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31995 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034520389661889004 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-fg3m-vhrr-8gj6 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-command-injection-via-windows-shell-fallback-in-lobster-extension · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-31995 · Nota de Segurança
• https://twitter.com/CVEarity/status/2034880054816383474 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05251 · Nota de Segurança