OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.
References
Configurations
History
19 Mar 2026, 19:20
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* | |
| First Time |
Openclaw openclaw
Openclaw |
|
| References | () https://github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fb - Patch | |
| References | () https://github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph - Mitigation, Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/openclaw-command-injection-via-unescaped-environment-variables-in-windows-scheduled-task - Third Party Advisory |
19 Mar 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-19 02:16
Updated : 2026-03-19 19:20
NVD link : CVE-2026-22176
Mitre link : CVE-2026-22176
CVE.ORG link : CVE-2026-22176
JSON object : View
Products Affected
openclaw
- openclaw
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')