CVE-2026-31994: OpenClaw cmd injection

Q: Is CVE-2026-31994 actively exploited?

No confirmed active exploitation of CVE-2026-31994 has been reported, but organizations should still patch proactively.

Q: What systems are affected by CVE-2026-31994?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI automation pipelines, Windows-based AI deployments, model orchestration.

Q: What is the CVSS score for CVE-2026-31994?

CVE-2026-31994 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.57%.

CISO Take

OpenClaw versions prior to 2026.2.19 allow any local user with low privileges to inject arbitrary OS commands into Windows scheduled tasks by supplying cmd metacharacters or CR/LF sequences to the agent's gateway.cmd script generation routine. AI agent frameworks like OpenClaw commonly run with elevated service account privileges and orchestrate sensitive operations—API calls, data pipelines, model inference—making this local escalation path significantly more dangerous than the attack vector alone suggests. EPSS places this in the top 57% for exploitation likelihood, and the package's history of 396 CVEs signals systemic security debt that warrants scrutiny of your OpenClaw deployment posture beyond this single patch. Upgrade immediately to 2026.2.19+; if patching is delayed, enforce strict input validation on script generation arguments to reject metacharacters and inject-sensitive sequences, and audit existing gateway.cmd files for signs of tampering.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium-High in AI agent environments. The local attack vector reduces remote exposure, but the low privilege and zero user interaction requirements lower the bar for exploitation in shared Windows environments. AI agent frameworks frequently run as privileged service accounts with access to secrets, model artifacts, and downstream infrastructure—meaning a local foothold on an OpenClaw host carries outsized blast radius. The package's 396-CVE history indicates a pattern of insufficient input sanitization rather than an isolated incident, increasing confidence that this class of vulnerability may recur. With only 4 downstream dependents, supply chain amplification is limited, but any organization running Windows-based OpenClaw orchestration should treat this as a priority patch.

How does the attack unfold?

Local Access

Attacker obtains a low-privileged local account on a Windows host running OpenClaw, via phishing, an unrelated CVE, or insider access.

AML.T0012

Argument Injection

Attacker supplies cmd metacharacters (e.g., ^&, |, CR/LF) as values to OpenClaw's gateway.cmd script generation arguments, embedding malicious commands in the generated scheduled task script.

AML.T0081

Scheduled Task Execution

Windows Task Scheduler invokes the malformed gateway.cmd; cmd.exe processes the injected metacharacters and executes the attacker's payload in the OpenClaw service account context.

AML.T0050

Impact

Attacker achieves arbitrary code execution with the agent's elevated privileges, enabling exfiltration of stored API keys, model artifacts, and database credentials, or lateral movement to connected AI infrastructure.

AML.T0112.000

Local Access

Attacker obtains a low-privileged local account on a Windows host running OpenClaw, via phishing, an unrelated CVE, or insider access.

AML.T0012

Argument Injection

Attacker supplies cmd metacharacters (e.g., ^&, |, CR/LF) as values to OpenClaw's gateway.cmd script generation arguments, embedding malicious commands in the generated scheduled task script.

AML.T0081

Scheduled Task Execution

Windows Task Scheduler invokes the malformed gateway.cmd; cmd.exe processes the injected metacharacters and executes the attacker's payload in the OpenClaw service account context.

AML.T0050

Impact

Attacker achieves arbitrary code execution with the agent's elevated privileges, enabling exfiltration of stored API keys, model artifacts, and database credentials, or lateral movement to connected AI infrastructure.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

1 step

1) Patch: Upgrade OpenClaw to version 2026.2.19 or later. The fix commit (280c6b1) addresses metacharacter and CR/LF handling in gateway.cmd generation. 2) Workaround: If immediate patching is not possible, sanitize all inputs to script generation functions by allowlisting alphanumeric characters and safe delimiters, explicitly rejecting ^, &, |, >, <, %, !, CR, and LF sequences. 3) Least privilege: Ensure OpenClaw service accounts run with the minimum permissions necessary—restrict write access to Task Scheduler and system directories. 4) Detection: Audit Windows Task Scheduler logs (Event IDs 4698, 4702) for tasks spawned by OpenClaw with unexpected command arguments or child processes. Review all existing gateway.cmd files for embedded metacharacters. 5) Monitor: Alert on anomalous process lineage from Windows Task Scheduler parent processes associated with OpenClaw service accounts.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent AML.T0050 - Command and Scripting Interpreter AML.T0081 - Modify AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - Security of AI systems A.9.3 - Actions to address AI risks and opportunities

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain value of deployed AI systems

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-31994?

OpenClaw versions prior to 2026.2.19 allow any local user with low privileges to inject arbitrary OS commands into Windows scheduled tasks by supplying cmd metacharacters or CR/LF sequences to the agent's gateway.cmd script generation routine. AI agent frameworks like OpenClaw commonly run with elevated service account privileges and orchestrate sensitive operations—API calls, data pipelines, model inference—making this local escalation path significantly more dangerous than the attack vector alone suggests. EPSS places this in the top 57% for exploitation likelihood, and the package's history of 396 CVEs signals systemic security debt that warrants scrutiny of your OpenClaw deployment posture beyond this single patch. Upgrade immediately to 2026.2.19+; if patching is delayed, enforce strict input validation on script generation arguments to reject metacharacters and inject-sensitive sequences, and audit existing gateway.cmd files for signs of tampering.

Is CVE-2026-31994 actively exploited?

No confirmed active exploitation of CVE-2026-31994 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31994?

1) Patch: Upgrade OpenClaw to version 2026.2.19 or later. The fix commit (280c6b1) addresses metacharacter and CR/LF handling in gateway.cmd generation. 2) Workaround: If immediate patching is not possible, sanitize all inputs to script generation functions by allowlisting alphanumeric characters and safe delimiters, explicitly rejecting ^, &, |, >, <, %, !, CR, and LF sequences. 3) Least privilege: Ensure OpenClaw service accounts run with the minimum permissions necessary—restrict write access to Task Scheduler and system directories. 4) Detection: Audit Windows Task Scheduler logs (Event IDs 4698, 4702) for tasks spawned by OpenClaw with unexpected command arguments or child processes. Review all existing gateway.cmd files for embedded metacharacters. 5) Monitor: Alert on anomalous process lineage from Windows Task Scheduler parent processes associated with OpenClaw service accounts.

What systems are affected by CVE-2026-31994?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI automation pipelines, Windows-based AI deployments, model orchestration.

What is the CVSS score for CVE-2026-31994?

CVE-2026-31994 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI automation pipelinesWindows-based AI deploymentsmodel orchestration

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0081 Modify AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.5, A.9.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context.

Exploitation Scenario

An attacker who has obtained a low-privileged local account on a Windows server running an OpenClaw AI agent—via phishing, a separate unpatched CVE, or an insider—identifies that OpenClaw generates gateway.cmd scheduled task scripts using caller-controlled arguments without sanitization. The attacker supplies a value such as `legitimate_arg^&whoami>C:\output.txt` to the script generation interface. When Windows Task Scheduler executes the generated gateway.cmd, the cmd.exe interpreter processes the metacharacter-delimited payload, running the injected command in the OpenClaw service account's security context. In a typical AI agent deployment, this account has access to stored API keys (OpenAI, Anthropic, cloud providers), model artifact storage, and database credentials—enabling the attacker to exfiltrate these secrets or establish persistence via additional scheduled tasks, replicating the AIID #1368 OpenClaw credential exfiltration pattern through a different technical path.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.