Executive brief
OpenClaw is a platform that executes extension tools, including a Windows-based Lobster extension. A flaw in the Lobster tool execution allows attackers with local access to inject shell commands through command arguments when subprocess execution fails on Windows. This could allow an attacker to run arbitrary code on the system.
Technical details
The vulnerability is an OS command injection (CWE-78) in the Lobster extension's tool execution mechanism. In affected versions (≤ 2026.2.17), when launching Lobster wrappers (.cmd/.bat files) on Windows, the code retries subprocess invocation with shell: true after EINVAL or ENOENT spawn errors. Because shell metacharacters in command arguments are then interpreted by the shell, an attacker can inject shell commands. The attack requires local access and prior knowledge of tool execution parameters. The fix (version 2026.2.19) removes the shell-based fallback and uses explicit argv execution with resolved wrapper entrypoints instead.
Affected products
- OpenClaw openclaw < 2026.2.19
Timeline
- 2026-02-21: disclosed
- 2026-02-19: patched: Fix commit ba7be018da354ea9f803ed356d20464df0437916