Executive brief
OpenClaw is a cross-platform gateway tool used to manage service installation and execution. A command injection vulnerability exists in how it generates Windows Scheduled Task scripts—untrusted environment variables are inserted without proper escaping, allowing an attacker with control over configuration or environment values to inject shell commands that execute with system privileges when the service starts.
Technical details
The vulnerability is a command injection (CWE-78) in the Windows Scheduled Task script generator (src/daemon/schtasks.ts). Environment variable assignments were written as unquoted `set KEY=VALUE` directives into gateway.cmd, allowing metacharacters (e.g., `&`, `|`, `^`, `%`, `!`) in config-supplied values to break out of assignment context and alter cmd.exe command flow. The attack requires ability to influence configuration files or environment values before gateway installation/reinstallation (e.g., shared config templates, setup scripts, or automation). The fix (commit dafe52e8cf1a041d898cfb304a485fa05e5f58fb) applies quoting and explicit metacharacter escaping to env assignments. Patches are available in version 2026.2.19 and later.
Affected products
- OpenClaw openclaw <= 2026.2.17
Timeline
- 2026-02-21: disclosed
- 2026-02-19: patched: Fix commit dafe52e8cf1a041d898cfb304a485fa05e5f58fb
- 2026-03-03: advisory