What is the CVSS score of EUVD-2026-13027?

EUVD-2026-13027 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by EUVD-2026-13027?

OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability that allows authenticated attackers to execute arbitrary code through scheduled task scripts on Windows systems.. A patch is available.

How to fix or mitigate EUVD-2026-13027?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.2.19 and assess which have local user access. Within 7 days: Apply vendor patch to version 2026.2.19 or later across all affected systems, prioritizing production environments and systems with sensitive scheduled tasks. Within 30 days: Complete patching of all remaining systems and validate through testing that scheduled tasks execute without interference.

Openclaw EUVD-2026-13027

| CVE-2026-31994 HIGH

OS Command Injection (CWE-78)

2026-03-19 VulnCheck

GHSA-mqr9-vqhq-3jxw

Command Injection Microsoft Openclaw Windows

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 01:30 euvd

EUVD-2026-13027

Analysis Generated

Mar 19, 2026 - 01:30 vuln.today

Patch released

Mar 19, 2026 - 01:30 nvd

Patch available

CVE Published

Mar 19, 2026 - 01:00 nvd

HIGH 7.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context.

AnalysisAI

OpenClaw contains a local command injection vulnerability in Windows scheduled task script generation that allows authenticated local attackers to inject arbitrary commands through unsafe handling of cmd metacharacters and CR/LF sequences in gateway.cmd files. OpenClaw versions prior to 2026.2.19 are affected. Attackers with control over service script generation arguments can execute unintended code in the scheduled task context with high impact to integrity and availability.

Technical ContextAI

This vulnerability affects OpenClaw (cpe:2.3:a:openclaw:openclaw), an application that generates Windows scheduled task scripts with .cmd extensions. The root cause is CWE-78 (OS Command Injection), where the application fails to properly sanitize user-controlled input before incorporating it into gateway.cmd script files. Windows cmd.exe interprets special metacharacters (such as &, |, <, >, ^) and expansion-sensitive characters, as well as carriage return/line feed (CR/LF) sequences, which can break out of intended command context. When these unsanitized values are passed as arguments during service script generation, they enable command injection that executes when the scheduled task runs. This is a classic example of improper neutralization of special elements used in OS commands.

RemediationAI

Upgrade OpenClaw to version 2026.2.19 or later, which contains the fix implemented in commit 280c6b117b2f0e24f398e5219048cd4cc3b82396 available at https://github.com/openclaw/openclaw/commit/280c6b117b2f0e24f398e5219048cd4cc3b82396. Review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-mqr9-vqhq-3jxw for complete remediation guidance. Until patching is completed, restrict the ability for low-privileged users to control service script generation arguments, audit existing gateway.cmd scheduled tasks for suspicious command sequences, and implement strict input validation if custom script generation workflows are in use. Consider temporarily disabling automated scheduled task creation features if exploitation risk is deemed immediate in your environment.