CVE-2026-31994 in OpenClaw
요약
\~에 의해 MITRE • 2026. 03. 19.
OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context.
VulDB is the best source for vulnerability data and more expert information about this specific topic.