CVE-2026-32000

OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

State: Published
Severity: 5.8 Medium
Published: Mar 19, 2026
Updated: Jun 23, 2026
Reserved: Mar 10, 2026

Description

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.

Scores

CVSS	Score	Vector	Source
4.0	5.8 Medium	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.2.19Affected 2026.2.19Not affected

References

GitHub Security Advisory (GHSA-7fcc-cw49-xm78)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Executionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.