PT-2026-27244 · Openclaw · Openclaw

Tdjackey · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32912

NVD

CVSS v3.1

5.8

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

OpenClaw versions 2026.2.26 before 2026.3.1 contain a current working directory injection vulnerability in Windows wrapper resolution for .cmd/.bat files that allows shell execution fallback. Attackers can manipulate the current working directory to alter wrapper resolution behavior and achieve command execution integrity loss.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2026-32912

Affected Products

Openclaw

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32912 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j · Note
• https://vulncheck.com/advisories/openclaw-mar-current-working-directory-injection-via-windows-wrapper-resolution-fallback · Note