Executive brief
OpenClaw is a Node.js-based automation tool with a Lobster extension that manages shell command execution. On Windows, when the normal process spawn fails, the tool falls back to shell execution, which can interpret special characters in user-controlled arguments as commands. An attacker with local workflow definition access can inject arbitrary commands through tool arguments, potentially leading to unauthorized code execution.
Technical details
OpenClaw's Lobster extension on Windows uses shell fallback (shell: true) when spawn operations fail with ENOENT or EINVAL errors. The fallback path does not properly sanitize tool-provided arguments before passing them to cmd.exe, allowing OS command injection via special characters that cmd.exe interprets as command separators or operators. The vulnerability requires Windows, specific spawn failure conditions, and local operator control over workflow definitions. The fix (version 2026.2.19 and later) removes the unsafe shell fallback and instead resolves .cmd/.bat shims to concrete Node entrypoints executed with explicit argv, eliminating shell interpretation. If a safe entrypoint cannot be resolved, execution fails with a guided error rather than attempting shell fallback.
Affected products
- OpenClaw OpenClaw >= 2026.1.21, <= 2026.2.17
Timeline
- 2026-02-21: disclosed
- 2026-02-21: patched: Fix version 2026.2.19 pre-set for next release
- 2026-03-19: advisory