PT-2026-26239 · Openclaw+1 · Openclaw+1

Tdjackey · Published 2026-03-02 · Updated 2026-03-22 · CVE-2026-31999

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.26 through 2026.3.1

Description OpenClaw on Windows contains a current working directory injection flaw in wrapper resolution for .cmd/.bat files. This allows attackers to influence execution behavior through current working directory (cwd) manipulation. Improper shell execution fallback mechanisms can lead to command execution integrity loss by controlling the cwd during wrapper resolution. The issue affects Windows ACPX paths where wrapper resolution for .cmd/.bat files could fall back to shell execution, enabling cwd influence to alter execution behavior.

Recommendations OpenClaw versions 2026.2.26 through 2026.3.1 should be updated to version 2026.3.1.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-05042

CVE-2026-31999

GHSA-6F6J-WX9W-FF4J

GHSA-H36M-2VH5-X699

Affected Products

Openclaw

Windows

References · 14

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h36m-2vh5-x699 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6f6j-wx9w-ff4j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31999 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05042 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31999 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-current-working-directory-injection-via-windows-wrapper-resolution-fallback · Note
• https://twitter.com/CVEnew/status/2034520386029707455 · Twitter Post
• https://twitter.com/cyberbivash/status/2034467474859602240 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034480641262162068 · Twitter Post
• https://twitter.com/RedPacketSec/status/2034735879600697478 · Twitter Post
• https://twitter.com/CVEarity/status/2035246735401132456 · Twitter Post
• https://twitter.com/pulsepatchio/status/2035725737978900760 · Twitter Post