What is the CVSS score of CVE-2026-32908?

CVE-2026-32908 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Windows are affected by CVE-2026-32908?

OpenClaw versions 2026.1.21 through 2026.2.18 contain a command injection vulnerability that allows authenticated users with low privilege levels to execute arbitrary commands on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-32908?

Within 24 hours: Identify all systems running OpenClaw versions 2026.1.21 through 2026.2.18 and assess their criticality level. Within 7 days: Apply the available vendor patch to all non-production instances and conduct testing in a staging environment. Within 30 days: Complete patching of all production systems, prioritizing those with the highest privilege levels or data sensitivity; maintain an audit log of all patched systems.

Windows CVE-2026-32908

EUVD-2026-14590 HIGH

OS Command Injection (CWE-78)

2026-03-23 VulnCheck

GHSA-q528-m8hg-cjmr

Command Injection Microsoft Windows

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14590

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

Patch released

Mar 23, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 23, 2026 - 21:36 nvd

HIGH 7.0

DescriptionCVE.org

OpenClaw 2026.1.21 before 2026.2.19 contains a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows local operators to execute arbitrary commands. When spawn failures trigger shell fallback with shell: true, tool-provided arguments are interpreted by cmd.exe, enabling command injection through workflow-controlled parameters.

AnalysisAI

OpenClaw 2026.1.21 through 2026.2.18 contains a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism. Local authenticated users with low privileges can execute arbitrary commands when spawn failures trigger shell fallback with cmd.exe, exploiting workflow-controlled parameters. A patch is available from the vendor, and while no KEV or EPSS data indicates active exploitation at this time, the vulnerability has a CVSS score of 7.0 (High).

Technical ContextAI

The affected product is OpenClaw (cpe:2.3:a:openclaw:openclaw), specifically versions prior to 2026.2.19. This vulnerability manifests as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), occurring when the Lobster extension's process spawning mechanism fails and falls back to using Windows cmd.exe with the 'shell: true' option. In this fallback scenario, user-controlled arguments from workflow parameters are passed unsanitized to the command interpreter, allowing shell metacharacters and command separators to be injected and executed. This represents a classic command injection pattern where defensive controls break down in error-handling code paths that invoke system shells directly.

RemediationAI

Upgrade OpenClaw to version 2026.2.19 or later, which contains the fix for this command injection vulnerability. The patch is available from the vendor's GitHub repository at https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916. Organizations unable to upgrade immediately should restrict local access to OpenClaw installations to trusted users only, implement application whitelisting to prevent unauthorized command execution, and monitor for unusual process spawning behavior from OpenClaw processes. Review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-fg3m-vhrr-8gj6 for additional mitigation guidance specific to the Lobster extension configuration.