PT-2026-27244 · Openclaw+1 · Openclaw+1

Tdjackey · CVE-2026-32912 · Publicado 2026-03-23 · Atualizado 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.26 through 2026.3.0

Description The software contains a current working directory injection flaw in the Windows wrapper resolution process for .cmd/.bat files, potentially leading to shell execution fallback. This allows attackers to manipulate the current working directory, altering wrapper resolution behavior and resulting in command execution integrity loss.

Recommendations Update to version 2026.3.1 or later.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2026-32912

Produtos afetados

Openclaw

Windows

Referências · 4

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j · Nota
• https://twitter.com/VulmonFeeds/status/2036262771340276113 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32912 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-mar-current-working-directory-injection-via-windows-wrapper-resolution-fallback · Nota