Executive brief
OpenClaw is a platform for AI agent execution and orchestration. The Lobster tool extension on Windows uses a shell fallback mechanism when subprocess launch fails, which allows shell metacharacters in command arguments to be interpreted by the shell, enabling attackers to inject arbitrary commands during tool execution.
Technical details
This vulnerability is a command injection flaw (CWE-78) in the Lobster extension's Windows tool execution code (extensions/lobster/src/lobster-tool.ts). When subprocess spawn fails with EINVAL or ENOENT errors, the code falls back to executing with shell: true, which causes shell metacharacters in command arguments to be interpreted as shell syntax rather than literal argument strings. An attacker who can control command arguments passed to Lobster tools can inject arbitrary shell commands. The fix removes the shell fallback entirely and instead resolves Windows wrapper executables (.cmd, .bat files) to explicit argv execution, eliminating the injection vector while maintaining Windows compatibility. Patch version 2026.2.19 is available.
Affected products
- OpenClaw openclaw <= 2026.2.17
Timeline
- 2026-03-03: disclosed: GHSA-7fcc-cw49-xm78 published
- 2026-02-19: patched: Fix commit ba7be018da354ea9f803ed356d20464df0437916 authored; patched version 2026.2.19 released