CVE-2026-22176

Katalog CVE

CVSS 7.8 · High EPSS 0,64%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada openclaw. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fb patch
• https://www.vulncheck.com/advisories/openclaw-command-injection-via-unescaped-environment-variables-in-windows... advisory pihak ketiga