EUVD-2026-13039
GHSA-7fcc-cw49-xm78
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.
AnalysisAI
Command injection in OpenClaw versions before 2026.2.19 allows local attackers with limited privileges to execute arbitrary commands when the Lobster extension tool falls back to Windows shell execution after subprocess failures. The vulnerability exists because the tool uses shell: true after spawn errors, enabling attackers to inject shell metacharacters into command arguments. A patch is available for affected users.
Technical ContextAI
The vulnerability exists in OpenClaw's Lobster extension tool execution subsystem, which handles external process spawning. According to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the root cause is the unsafe use of shell=true in subprocess operations as a fallback mechanism after initial spawn failures. When the initial spawn attempt fails with EINVAL (Invalid Argument) or ENOENT (No Such File or Directory) errors, the code retries with Windows shell invocation enabled, but does not properly sanitize or escape command arguments. This allows attackers to embed shell metacharacters (such as pipes, redirects, or command separators) in arguments that are then interpreted by the Windows command shell rather than passed as literal strings. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), and the vulnerability is specific to Windows environments where shell fallback is triggered.
RemediationAI
Upgrade OpenClaw to version 2026.2.19 or later, which includes the patch fixing the shell fallback command injection vulnerability (commit ba7be018da354ea9f803ed356d20464df0437916 available at https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916). For systems unable to patch immediately, restrict local access to OpenClaw installations to trusted users only, disable or isolate the Lobster extension tool if not essential, and monitor subprocess execution patterns for anomalous command invocations. Ensure that the system does not rely on fallback mechanisms by validating tool paths and executable availability before OpenClaw startup. Complete the patch deployment as soon as feasible, as the vulnerability allows arbitrary command execution once triggered.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today