EUVD-2026-13951Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H) with a base score of 6.4 indicates moderate severity but requires nuanced interpretation. Attack vector is network-accessible (AV:N), which increases exposure, but attack complexity is high (AC:H) and requires legitimate low-privilege credentials (PR:L) plus user interaction (UI:R), which together significantly constrain real-world exploitability. The impact is severe: no confidentiality loss but high integrity and availability damage. The absence of confidentiality impact and the high complexity/interaction requirements suggest this is not a trivial remote wipe scenario. However, the availability and integrity impact combined with network accessibility makes this a legitimate concern for environments where OpenClaw is deployed with untrusted users. Exploitation likely requires social engineering (misleading approval text) to trick users into executing commands, making this operationally feasible but not automatically triggerable. The availability of a vendor patch and GitHub commits (0f0a680d3df81739ea5088a2f88e65f938b7936b and 55cf92578d266987e390c4bf688196af98eac748) indicates active vendor response. Without confirmed KEV status or public POC, this appears to be in the early disclosure phase, making prompt patching appropriate but not emergency-level. |
| Exploit ScenarioDerived | An attacker with valid low-privilege credentials on an OpenClaw installation crafts a command such as 'system.run("echo approved", "; rm -rf /data")' and presents it to a user with a misleading approval message like 'Approve minor configuration update'. The high attack complexity (AC:H) is overcome through social engineering: the approval text appears benign, but the positional argv injection causes the shell-wrapper to execute both the echo command and the hidden destructive command. Because UI:R is required, the attacker must convince a higher-privileged user to click 'approve', but once triggered, the arbitrary command executes with the privileges of the OpenClaw process, potentially compromising data integrity and system availability. No public POC is known at this time, but the attack is feasible for insiders or compromised accounts with system.run access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 21, 2026
OpenClaw versions before 2026.2.24 allow authenticated attackers to execute arbitrary commands through command injection in the system.run shell-wrapper by injecting malicious arguments that bypass validation controls. Public exploit code exists for this vulnerability, enabling attackers to disguise malicious payloads while executing hidden commands with the privileges of the affected application.
Earlier versions of this analysis (1)
OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper function that allows authenticated attackers with limited privileges to execute arbitrary commands by injecting positional argv carriers after inline shell payloads while crafting misleading approval text to bypass validation. The attack requires user interaction (UI interaction flag set in CVSS) but can result in integrity and availability compromise. A patch is available from the vendor, and the vulnerability was reported by VulnCheck with supporting references and commit-level fixes available on GitHub.
RemediationAI
Upgrade OpenClaw to version 2026.2.24 or later immediately. The vendor has released patches available via GitHub commits 0f0a680d3df81739ea5088a2f88e65f938b7936b and 55cf92578d266987e390c4bf688196af98eac748, which can be reviewed at https://github.com/openclaw/openclaw. If immediate patching is not feasible, restrict OpenClaw access to trusted users only and implement strict approval workflows that validate the full command context before execution. Additionally, deploy network segmentation to limit OpenClaw's exposure to authenticated users and consider disabling or sandboxing the system.run function until patching is complete. Monitor logs for suspicious positional argument injection patterns such as trailing semicolons, pipes, or command substitution syntax in approval requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in OpenClaw's shell-wrapper implementation (system.run function) which improperly handles positional command-line arguments. The root cause is classified under CWE-436 (Untrusted Input in Format String) and involves insufficient validation of argument boundaries and display context. Attackers exploit this by injecting trailing positional arguments that are processed by the shell interpreter after the visible inline payload, allowing hidden command execution. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), and the vulnerability specifically impacts versions before 2026.2.24. The shell-wrapper's failure to properly sanitize or isolate positional arguments from user-controlled input creates a classic command injection condition where an attacker can append shell metacharacters or additional commands that execute outside the intended command scope.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positional argv carriers after inline shell payloads. Attackers can craft misleading approval text while executing arbitrary commands through trailing positional arguments that bypass display context validation.
Executive ViewAI
CVE-2026-32052 presents moderate security risk rated CVSS 6.4. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in OpenClaw Multiple Authorization and Command Execution
View all 20Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Exploit-DB