PT-2026-27239 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32907

NVD

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenClaw before 2026.2.19 contains a local command injection vulnerability in Windows scheduled task script generation that allows attackers to execute arbitrary commands by injecting cmd metacharacters into unsafe gateway.cmd arguments. Attackers with control over service script generation values can inject unescaped metacharacters or expansion-sensitive characters to achieve unintended command execution in the scheduled task context.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-32907

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/280c6b117b2f0e24f398e5219048cd4cc3b82396 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32907 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mqr9-vqhq-3jxw · Note
• https://vulncheck.com/advisories/openclaw-mar-local-command-injection-via-windows-scheduled-task-script-generation · Note