CVE-2026-22168

Katalog CVE

CVSS 8.8 · High EPSS 0,41%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada openclaw. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments through cmd.exe /c to achieve local command execution on trusted Windows nodes with mismatched audit logs.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5v6x-rfc3-7qfr advisory vendor
• https://github.com/openclaw/openclaw/commit/6007941f04df1edcca679dd6c95949744fdbd4df patch
• https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmd-exe-c-trailing-arguments-in-system-run advisory pihak ketiga