Executive brief
OpenClaw is a Node.js-based workflow execution and automation tool. On Windows, when certain command execution failures occur, the tool would fall back to using the system shell (cmd.exe) for compatibility with batch script wrappers. This fallback path fails to properly sanitize arguments, allowing a local attacker with control over workflow inputs to inject arbitrary shell commands on Windows systems.
Technical details
The vulnerability is an OS command injection (CWE-78) in the Lobster extension's Windows shell fallback mechanism. When spawn operations fail with ENOENT or EINVAL errors, the code retries with shell: true to maintain compatibility with .cmd/.bat wrapper scripts. In this fallback path, tool-provided arguments are directly passed to cmd.exe without proper escaping, allowing injection of arbitrary shell metacharacters. The attack requires Windows OS and fallback-triggering conditions (e.g., missing or incompatible executable), plus local control over workflow-defined arguments. The fix removes the unsafe fallback entirely and instead resolves .cmd/.bat shims to concrete Node entrypoints, executing with explicit argv arrays that bypass shell interpretation. If resolution fails, execution now fails safely with an error rather than falling back to cmd.exe.
Affected products
- OpenClaw OpenClaw >= 2026.1.21, <= 2026.2.17
Timeline
- 2026-03-03: disclosed
- 2026-02-21: patched: Patched version 2026.2.19