PT-2026-23520 · Openclaw+1 · Openclaw+1

Petr Simecek

·

Published

2026-02-17

·

Updated

2026-03-10

·

CVE-2026-28391

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.2
Description The software does not properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests, potentially allowing attackers to bypass command approval restrictions. Attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations. The software uses cmd.exe /d /s /c <rawCommand> for executing requests on Windows nodes. The allowlist analysis does not model Windows cmd.exe parsing and metacharacter behavior. The vulnerable code is located in src/infra/node-shell.ts. The fix hardens Windows allowlist enforcement by passing the platform into allowlist analysis, rejecting Windows shell metacharacters, treating cmd.exe invocation as not allowlist-safe on Windows, and avoiding cmd.exe entirely in allowlist mode by executing the parsed argv directly when possible.
Recommendations Update to version 2026.2.2 or later.

Fix

OS Command Injection

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-78CWE-184

Related Identifiers

CVE-2026-28391
GHSA-QJ77-C3C8-9C3Q

Affected Products

Openclaw
Windows