Kurz gesagt
- CVE-2026-28391 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in openclaw (openclaw), openclaw.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.58%, höher als bei 47.7% aller Schwachstellen.
- Abhilfe: auf 2026.2.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.2
| 2026.2.2
|
| openclaw npm | < 2026.2.2
| 2026.2.2
|
Description
Summary
On Windows nodes, exec requests were executed via cmd.exe /d /s /c <rawCommand>. In allowlist/approval-gated mode, the allowlist analysis did not model Windows cmd.exe parsing and metacharacter behavior. A crafted command string could cause cmd.exe to interpret additional operations (for example command chaining via &, or expansion via %...% / !...!) beyond what was allowlisted/approved.
Affected Packages / Versions
- Package:
openclaw (npm)
- Affected:
<= 2026.2.1
- Patched:
>= 2026.2.2
- Latest (npm) as of 2026-02-14:
2026.2.13
Details
- Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes.
- Windows execution uses
cmd.exe via src/infra/node-shell.ts.
- The fix hardens Windows allowlist enforcement by:
- Passing the platform into allowlist analysis and rejecting Windows shell metacharacters.
- Treating
cmd.exe invocation as not allowlist-safe on Windows.
- Avoiding
cmd.exe entirely in allowlist mode by executing the parsed argv directly when possible.
Fix Commit(s)
a7f4a53ce80c98ba1452eb90802d447fca9bf3d6
Thanks @simecek for reporting.
NVD description
OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free