What’s Vulnerable › Vulnerabilities

CVE-2026-31995: OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-19 · updated 2026-06-17
• Weakness: CWE-78

Description

OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true, attackers can exploit cmd.exe command interpretation to execute malicious commands by controlling workflow arguments.

Affected products

• OpenClaw: from 2026.1.21 before 2026.2.19 — fixed in 2026.2.19

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.19. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fg3m-vhrr-8gj6
• https://www.vulncheck.com/advisories/openclaw-command-injection-via-windows-shell-fallback-in-lobster-extension

Get alerted when CVE-2026-31995 or the next vulnerability affects your stack