Medium severity6.1NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026
CVE-2026-22176
CVE-2026-22176
Description
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.19 | 2026.2.19 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fbnvdPatchWEB
- github.com/advisories/GHSA-pj5x-38rw-6fphghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fphnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-22176ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-command-injection-via-unescaped-environment-variables-in-windows-scheduled-tasknvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.