PT-2026-27221 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-22173

NVD

CVSS v3.1

7.4

High

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OpenClaw versions prior to 2026.2.18 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written unquoted to gateway.cmd, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through config-provided environment variables when the scheduled task script is generated and executed.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-22173

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22173 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph · Note
• https://vulncheck.com/advisories/openclaw-mar-command-injection-via-unescaped-environment-assignments-in-windows-scheduled-task-script-generation · Note