CVE-2026-31995: OpenClaw cmd injection

CISO Take

OpenClaw versions prior to 2026.2.19 contain a command injection flaw (CWE-78) in its Lobster extension: when a subprocess spawn fails on Windows, the extension silently falls back to cmd.exe with shell:true, allowing anyone who controls workflow arguments to execute arbitrary OS commands on the host. While the CVSS of 5.3 reflects local access and high complexity, the EPSS places this in the top 60% of vulnerabilities most likely to be exploited, and AIID #1368 confirms that OpenClaw's extension ecosystem is already being actively abused by threat actors to deliver stealers and exfiltrate credentials—raising the practical threat model well above what the base score alone suggests. AI agent pipelines that ingest external content (RAG lookups, LLM-generated tool arguments, user-supplied prompts) effectively convert this 'local' vulnerability into a reachable attack surface. Organizations running OpenClaw on Windows should upgrade to 2026.2.19 immediately, audit whether workflow arguments can be influenced by external input, and deploy EDR rules to detect anomalous cmd.exe children from OpenClaw processes.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS AIID

What is the risk?

Medium by CVSS, but elevated in practice for any agentic deployment on Windows where workflow arguments derive from LLM output, RAG-retrieved content, or chained tool calls. The 'local' attack vector assumes a traditional threat model; agentic pipelines that process attacker-reachable external data effectively collapse the local/remote distinction. High complexity reflects the requirement to trigger a spawn failure, which may be achievable under resource pressure or via antivirus interference. Four downstream dependents suggest limited pip ecosystem blast radius, but direct OpenClaw installations in enterprise automation pipelines remain the primary exposure.

How does the attack unfold?

Argument Injection

Attacker supplies malicious strings containing cmd.exe metacharacters through a reachable input channel—crafted document, RAG-retrieved content, LLM tool output, or user prompt processed by the OpenClaw agent.

AML.T0053

Shell Fallback Trigger

A subprocess spawn failure in the Lobster extension silently activates the Windows shell fallback, re-executing the argument string via cmd.exe with shell:true enabled.

AML.T0050

Arbitrary Command Execution

cmd.exe interprets the attacker-controlled argument as a shell command sequence, executing arbitrary OS commands with the AI agent process's privilege level.

AML.T0050

Host Compromise

Attacker achieves persistent access, credential theft via OS credential dumping, or lateral movement from the compromised AI agent host, escalating impact beyond the agent process boundary.

AML.T0112.000

Argument Injection

Attacker supplies malicious strings containing cmd.exe metacharacters through a reachable input channel—crafted document, RAG-retrieved content, LLM tool output, or user prompt processed by the OpenClaw agent.

AML.T0053

Shell Fallback Trigger

A subprocess spawn failure in the Lobster extension silently activates the Windows shell fallback, re-executing the argument string via cmd.exe with shell:true enabled.

AML.T0050

Arbitrary Command Execution

cmd.exe interprets the attacker-controlled argument as a shell command sequence, executing arbitrary OS commands with the AI agent process's privilege level.

AML.T0050

Host Compromise

Attacker achieves persistent access, credential theft via OS credential dumping, or lateral movement from the compromised AI agent host, escalating impact beyond the agent process boundary.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

1) Upgrade OpenClaw to version 2026.2.19 or later using the patch at commit ba7be018. 2) If patching is delayed, disable or remove the Lobster extension on all Windows hosts. 3) Audit all workflow argument pipelines: ensure no untrusted or LLM-generated input can reach subprocess calls without sanitization or allowlisting. 4) Enforce least-privilege on AI agent process accounts—restrict filesystem and network access to the minimum required. 5) Deploy EDR rules to alert on cmd.exe or powershell.exe spawned as children of OpenClaw or the Lobster extension process. 6) Cross-reference AIID #1368 IoCs (malicious ClawHub skills) and audit any third-party extensions loaded in the environment.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.2 - AI system risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms exist to sustain management of AI risks

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-31995?

OpenClaw versions prior to 2026.2.19 contain a command injection flaw (CWE-78) in its Lobster extension: when a subprocess spawn fails on Windows, the extension silently falls back to cmd.exe with shell:true, allowing anyone who controls workflow arguments to execute arbitrary OS commands on the host. While the CVSS of 5.3 reflects local access and high complexity, the EPSS places this in the top 60% of vulnerabilities most likely to be exploited, and AIID #1368 confirms that OpenClaw's extension ecosystem is already being actively abused by threat actors to deliver stealers and exfiltrate credentials—raising the practical threat model well above what the base score alone suggests. AI agent pipelines that ingest external content (RAG lookups, LLM-generated tool arguments, user-supplied prompts) effectively convert this 'local' vulnerability into a reachable attack surface. Organizations running OpenClaw on Windows should upgrade to 2026.2.19 immediately, audit whether workflow arguments can be influenced by external input, and deploy EDR rules to detect anomalous cmd.exe children from OpenClaw processes.

Is CVE-2026-31995 actively exploited?

No confirmed active exploitation of CVE-2026-31995 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31995?

1) Upgrade OpenClaw to version 2026.2.19 or later using the patch at commit ba7be018. 2) If patching is delayed, disable or remove the Lobster extension on all Windows hosts. 3) Audit all workflow argument pipelines: ensure no untrusted or LLM-generated input can reach subprocess calls without sanitization or allowlisting. 4) Enforce least-privilege on AI agent process accounts—restrict filesystem and network access to the minimum required. 5) Deploy EDR rules to alert on cmd.exe or powershell.exe spawned as children of OpenClaw or the Lobster extension process. 6) Cross-reference AIID #1368 IoCs (malicious ClawHub skills) and audit any third-party extensions loaded in the environment.

What systems are affected by CVE-2026-31995?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic automation pipelines, AI workstations.

What is the CVSS score for CVE-2026-31995?

CVE-2026-31995 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic automation pipelinesAI workstations

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true, attackers can exploit cmd.exe command interpretation to execute malicious commands by controlling workflow arguments.

Exploitation Scenario

An attacker crafts a malicious document or web resource containing workflow argument strings with Windows cmd.exe metacharacters (e.g., 'legitimate-arg & net user backdoor P@ss1234 /add'). When an OpenClaw agent ingests this content—via a RAG lookup, file tool call, or LLM-directed fetch—the Lobster extension attempts to spawn a subprocess with the attacker-controlled string as an argument. Under conditions that cause the spawn to fail (resource limits, AV blocking, path resolution failure), the fallback mechanism re-invokes the command through cmd.exe with shell:true, executing the injected payload with the AI agent's process privileges. From this foothold, the attacker can dump credentials, establish persistence, or move laterally across the network.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.