CVE-2026-22176

MEDIUM

OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation

Title source: cna
STIX 2.1

Description

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-pj5x-38rw-6fph)
https://github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation
https://www.vulncheck.com/advisories/openclaw-command-injection-via-unescaped-environment-variables-in-windows-scheduled-task

Scores

CVSS v3 6.1
EPSS 0.0064
EPSS Percentile 45.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (4)
npm/openclaw 0 - 2026.2.19npm
OpenClaw/OpenClaw < 2026.2.19
openclaw/openclaw < 2026.2.19
OpenClaw/OpenClaw 2026.2.19
Published Mar 19, 2026
Tracked Since Mar 19, 2026