CVE-2026-32000
Command Injection in OpenClaw Lobster Extension Enables Remote Code Execution
Publication date: 2026-03-19
Last updated on: 2026-03-25
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.2.19 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-32000, you should upgrade OpenClaw to version 2026.2.19 or later, where the vulnerable shell fallback mechanism has been removed.
The fix replaces the insecure Windows shell fallback execution with an explicit argument vector (argv) execution approach that prevents command injection.
Ensure that your environment does not rely on the vulnerable versions of the Lobster extension tool and verify that the updated version is deployed.
Can you explain this vulnerability to me?
CVE-2026-32000 is a command injection vulnerability in OpenClaw versions prior to 2026.2.19, specifically in the Lobster extension tool on Windows. When the tool tries to launch subprocesses and encounters spawn failures with errors EINVAL or ENOENT, it falls back to using Windows shell execution with the option `shell: true`. This fallback allows attackers to inject shell metacharacters into command arguments, which the shell then interprets, enabling arbitrary command execution.
The root cause is improper neutralization of special shell elements (CWE-78), allowing externally influenced input to modify operating system commands executed downstream. The vulnerability was fixed by removing the shell fallback mechanism and instead resolving Windows wrappers to explicit executable or script argument vectors, preventing shell interpretation of command arguments.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited privileges to execute arbitrary commands on a Windows system running vulnerable versions of OpenClaw. Because the fallback to shell execution interprets shell metacharacters, an attacker could inject malicious commands that the system would execute, potentially leading to unauthorized actions, system compromise, or disruption of service.
The severity is rated as moderate with a CVSS v4 base score of 5.8, indicating a significant risk especially in environments where the Lobster tool is used and subprocess spawn failures occur.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know