CVE-2026-28391
CVE-2026-28391 · OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations.
CVSS 9.2 · Kritisch · EPSS 0,5% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node
Betroffene Produkte und Versionen
Originalquellen
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qj77-c3c8-9c3q
- https://github.com/openclaw/openclaw/commit/a7f4a53ce80c98ba1452eb90802d447fca9bf3d6
- https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmdexe-parsing-bypass-in-allowlist-enforcement
- https://nvd.nist.gov/vuln/detail/CVE-2026-28391