PT-2026-26240 · Openclaw+1 · Openclaw+1

Sean Nejad · Publicado 2026-02-19 · Atualizado 2026-03-21 · CVE-2026-32000

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.19 OpenClaw versions 2026.2.17 and earlier

Description OpenClaw versions prior to 2026.2.19 contain a command injection issue in the Lobster extension tool execution. This occurs due to the use of a Windows shell fallback mechanism with shell: true after process creation failures. Attackers can inject shell metacharacters into command arguments, potentially executing arbitrary commands when the subprocess launch fails with EINVAL or ENOENT errors. The issue resides in the extensions/lobster/src/lobster-tool.ts file, where the tool retries subprocess launch with shell: true on Windows for specific errors. The fix removes the shell fallback and uses explicit executable/script argv execution.

Recommendations OpenClaw versions prior to 2026.2.19 should be updated to version 2026.2.19 or later.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2026-05004

CVE-2026-32000

GHSA-5RP4-CWGH-GVWQ

GHSA-7FCC-CW49-XM78

Produtos afetados

Blobster

Openclaw

Referências · 15

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7fcc-cw49-xm78 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916 · Correção
• https://twitter.com/VulmonFeeds/status/2034485760741576788 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034520385119564149 · Publicação no Twitter
• https://twitter.com/NewsNerdie/status/2034691844932546696 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05004 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-32000 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2034467452218728724 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-command-injection-via-windows-shell-fallback-in-lobster-tool-execution · Nota
• https://twitter.com/CVEarity/status/2035246829840081318 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32000 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5rp4-cwgh-gvwq · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/2034735880829542606 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-7fcc-cw49-xm78 · Aviso do Fabricante