What is the CVSS score of CVE-2026-32003?

CVE-2026-32003 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32003?

CVE-2026-32003 presents notable security risk, a OS command injection vulnerability rated CVSS 6.6. Exploitation could allow attackers to execute code or inject malicious input.. A patch is available.

How to fix or mitigate CVE-2026-32003?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Openclaw CVE-2026-32003

MEDIUM

OS Command Injection (CWE-78)

2026-03-19 disclosure@vulncheck.com

GHSA-2fgq-7j6h-9rm4

Command Injection Openclaw

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.6

DescriptionCVE.org

OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command allowlist restrictions via SHELLOPTS and PS4 environment variables. An attacker who can invoke system.run with request-scoped environment variables can execute arbitrary shell commands outside the intended allowlisted command body through bash xtrace expansion.

AnalysisAI

OpenClaw versions before 2026.2.22 allow high-privileged attackers to execute arbitrary shell commands by injecting malicious environment variables into the system.run function, bypassing the intended command allowlist protections. By exploiting bash xtrace expansion through SHELLOPTS and PS4 variables, an attacker with request-scoped environment variable access can achieve code execution beyond the restricted command set. No patch is currently available for this command injection vulnerability.

Technical ContextAI

The vulnerability resides in OpenClaw's system.run function, which implements a command allowlist mechanism intended to restrict which shell commands can be executed. However, the implementation fails to sanitize environment variables passed in request scope, specifically SHELLOPTS and PS4—bash-specific environment variables that control shell behavior and debugging output respectively. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) categorizes this as an OS command injection flaw. When bash xtrace mode (set -x) is enabled via PS4 or SHELLOPTS, bash expands the PS4 variable before executing commands, allowing attackers to inject arbitrary code that executes outside the allowlist validation layer. The attack leverages bash's internal expansion semantics to circumvent the security boundary intended by the allowlist mechanism.

RemediationAI

Immediately upgrade OpenClaw to version 2026.2.22 or later to apply the security patch. See the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2fgq-7j6h-9rm4 for verification of patched versions. Until patching is completed, implement network-level access controls to restrict authenticated user access to the system.run function to trusted administrator accounts only, and consider running OpenClaw in a restricted container environment with minimal environment variable propagation. Additionally, audit environment variables being passed to system.run invocations in application logs to detect potential exploit attempts using SHELLOPTS or PS4 injection patterns. Disabling bash xtrace mode system-wide can further mitigate exploitation but is not a substitute for patching.