PT-2026-26239 · Microsoft+1 · Windows+1

Tdjackey · CVE-2026-31999 · Publicado 2026-03-02 · Atualizado 2026-03-22

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.26 through 2026.3.1

Description OpenClaw on Windows contains a current working directory injection flaw in wrapper resolution for .cmd/.bat files. This allows attackers to influence execution behavior through current working directory (cwd) manipulation. Improper shell execution fallback mechanisms can lead to command execution integrity loss by controlling the cwd during wrapper resolution. The issue affects Windows ACPX paths where wrapper resolution for .cmd/.bat files could fall back to shell execution, enabling cwd influence to alter execution behavior.

Recommendations OpenClaw versions 2026.2.26 through 2026.3.1 should be updated to version 2026.3.1.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2026-05042

CVE-2026-31999

GHSA-6F6J-WX9W-FF4J

GHSA-H36M-2VH5-X699

Produtos afetados

Openclaw

Windows

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31999.json · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034480641262162068 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2035246735401132456 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034520386029707455 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-6f6j-wx9w-ff4j · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034467474859602240 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-current-working-directory-injection-via-windows-wrapper-resolution-fallback · Nota
• https://twitter.com/RedPacketSec/status/2034735879600697478 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31999 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h36m-2vh5-x699 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2035725737978900760 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05042 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-31999 · Aviso do Fabricante