High severityNVD Advisory· Published Mar 19, 2026· Updated Mar 23, 2026
OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation
CVE-2026-22176
Description
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.19 | 2026.2.19 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fbghsapatchWEB
- github.com/advisories/GHSA-pj5x-38rw-6fphghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fphghsathird-party-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-22176ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-command-injection-via-unescaped-environment-variables-in-windows-scheduled-taskghsathird-party-advisoryWEB
News mentions
0No linked articles in our index yet.