CVE-2026-32000CWE-78

OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

Medium · published March 19, 2026

CVSS v4.0
5.8
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.

The record
Technical detail
CVSS v4.0
5.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01109 · 65.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-19T01:00Z
EPSS history
Timeline
  • 19 MAR 01:00Z
    OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution
    cvelistv5