Openclaw CVE-2026-31995

The CVSS:3.1 score of 5.3 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L indicates moderate severity with important nuances. Attack Vector is Local, meaning an attacker must have local system access, which significantly reduces exposure in cloud and remote-only environments. Attack Complexity is High, suggesting exploitation requires non-trivial conditions (the spawn failure must occur and shell fallback must be triggered). Privilege Level is Low, meaning any authenticated user can attempt exploitation, making it viable in multi-user systems. The impact profile shows High Integrity (arbitrary code execution) but no Confidentiality impact and Low Availability impact, indicating this is primarily a privilege escalation or lateral movement vector rather than a system-wide denial-of-service. The vulnerability does not appear in the CISA KEV (Known Exploited Vulnerabilities) catalog based on available intelligence, and no public proof-of-concept is documented, suggesting limited active exploitation in the wild. However, the fundamental simplicity of command injection exploitation means threat actors will likely develop POCs once the patch details are analyzed. The real-world risk is moderate for organizations running OpenClaw in multi-user or containerized environments where local code execution by lower-privileged users is possible; isolated single-user deployments face lower risk. This is a legitimate priority that warrants timely patching but does not require emergency response procedures.

An attacker with local user access on a Windows system running OpenClaw submits a workflow job that intentionally triggers a process spawn failure (for example, by requesting an invalid or non-existent tool). When the system falls back to shell: true execution, the attacker controls the workflow arguments and injects a payload such as 'tool_arg | powershell -Command (malicious payload)' or 'tool_arg & del C:\critical\file.txt'. The cmd.exe interpreter processes these metacharacters, breaking out of the intended command context and executing the injected commands with the privileges of the OpenClaw process. While the CVSS High Attack Complexity rating suggests this is not trivial, the condition (spawn failure) can be reliably engineered, and no POC is currently documented in public sources, meaning the attacker must develop or adapt existing command injection techniques.