Local Command Injection Vulnerability in OpenClaw Package

openclaw Updated 04 Mar 2026

Summary

03/03/2026

Disclosed on

HIGH

Severity

Yes i

Fix available

High

Severity

8.5

CVSS Score

GHSA-mqr9-vqhq-3jxw: OpenClaw Windows Scheduled Task script generation allowed unsafe argument handling in generated gateway.cmd files. Affects openclaw versions < 2026.2.19. Fixed in 2026.2.19. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

OpenClaw is an open-source package designed for managing Windows Scheduled Tasks. It allows users to automate various tasks on Windows systems through script generation. However, it has been found to have a significant vulnerability that can lead to local command injection due to improper handling of command arguments in generated scripts.

Vulnerability Detail

The vulnerability arises from unsafe argument handling in the generated 'gateway.cmd' files. Specifically, the script generation process fails to properly quote or escape command metacharacters, allowing for unintended command execution when the scheduled task is triggered. This issue is localized to Windows deployments and requires an attacker to have control over the values used in service script generation, such as install-time or runtime arguments. The vulnerability is classified with a CVSS score of 8.5, indicating a high severity level.

How To Fix

Latest published version: 2026.10.6 as of 22 Oct 2026

npm install openclaw@2026.10.6

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

2026.2.19

This is the first release that contains the fix.

npm install openclaw@2026.2.19

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, ensure that any command arguments passed to the OpenClaw script generation are sanitized and do not include cmd metacharacters. Additionally, avoid using CR/LF characters in command arguments, task descriptions, and environment assignments.

Conclusion

The OpenClaw package has a critical vulnerability that allows for local command injection due to unsafe handling of command arguments in generated scripts. It is essential to update to the patched version 2026.2.19 or later to mitigate this risk. Users should also consider implementing workarounds until they can apply the update.

See every vulnerability recorded for openclaw →