CVE-2026-31999: OpenClaw CWD injection enables

CISO Take

OpenClaw, a Windows AI agent framework, contains a current working directory injection flaw in its .cmd/.bat wrapper resolution logic that allows a local attacker with low privileges to execute arbitrary commands by placing a malicious script in an attacker-controlled directory. Although the CVSS score is 6.3 (Medium) and the attack requires high complexity, EPSS places this in the top 85th percentile for exploitation likelihood, and OpenClaw's skills ecosystem was already actively abused to deliver credential-stealing malware (AIID #1368), demonstrating motivated threat actors targeting this exact platform. Successful exploitation corrupts AI agent command execution integrity with High integrity and High availability impact — an attacker can silently redirect tool invocations to arbitrary scripts without any network-level access. Organizations running OpenClaw on Windows should upgrade immediately to version 2026.3.1 and restrict agent process working directories to trusted, non-user-writable paths as a compensating control.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS AIID

What is the risk?

Medium risk overall, elevated for organizations where OpenClaw agents run in shared or user-influenced directories such as CI/CD runners, developer workstations, or multi-tenant agent platforms. The local attack vector (AV:L) prevents direct remote exploitation, but the high complexity requirement (AC:H) is achievable through workspace poisoning, CI/CD pipeline manipulation, or post-compromise staging — techniques well within the reach of threat actors who are already known to target OpenClaw's ecosystem. The absence of a public exploit and CISA KEV listing tempers urgency; however, the top-85th-percentile EPSS score signals meaningful attacker interest relative to the broader CVE population. Integrity and availability are both rated High, meaning exploitation can tamper with agent outputs or fully disrupt agent operations — a disproportionate operational impact for a Medium-severity CVSS score.

How does the attack unfold?

Staging

Attacker places a malicious .cmd/.bat file in a directory they control that coincides with OpenClaw's expected process working directory — achieved via a poisoned project workspace, compromised CI/CD job configuration, or a malicious skill package distributed through ClawHub.

AML.T0110

Trigger

A user or automated pipeline invokes OpenClaw in the poisoned directory, causing the agent to attempt wrapper resolution for a .cmd/.bat file via the Windows shell fallback mechanism, which searches the CWD before trusted system paths.

AML.T0053

Execution

The malicious script in the attacker-controlled CWD executes under OpenClaw's process identity instead of the legitimate wrapper binary, granting the attacker arbitrary command execution in the agent's security context.

AML.T0050

Impact

Attacker achieves command execution integrity loss — arbitrary commands run under the agent's context, agent outputs fed to downstream consumers are tampered or fabricated, and the agent process can be disrupted or used as a foothold for further lateral movement.

Staging

Attacker places a malicious .cmd/.bat file in a directory they control that coincides with OpenClaw's expected process working directory — achieved via a poisoned project workspace, compromised CI/CD job configuration, or a malicious skill package distributed through ClawHub.

AML.T0110

Trigger

A user or automated pipeline invokes OpenClaw in the poisoned directory, causing the agent to attempt wrapper resolution for a .cmd/.bat file via the Windows shell fallback mechanism, which searches the CWD before trusted system paths.

AML.T0053

Execution

The malicious script in the attacker-controlled CWD executes under OpenClaw's process identity instead of the legitimate wrapper binary, granting the attacker arbitrary command execution in the agent's security context.

AML.T0050

Impact

Attacker achieves command execution integrity loss — arbitrary commands run under the agent's context, agent outputs fed to downstream consumers are tampered or fabricated, and the agent process can be disrupted or used as a foothold for further lateral movement.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Upgrade OpenClaw to version 2026.3.1 immediately — this release eliminates the unsafe CWD fallback during wrapper resolution.
If patching is blocked, restrict the process working directory of all OpenClaw invocations to a trusted, non-user-writable system path via process launch configuration or CI/CD job definitions.
Apply least-privilege to OpenClaw processes — ensure agents do not run with administrative or elevated privileges to limit blast radius of exploitation.
Enable file integrity monitoring on directories where OpenClaw executes to detect unexpected .cmd/.bat files appearing at runtime.
Monitor Windows process creation (Event ID 4688 or Sysmon Event ID 1) for .cmd/.bat executions spawned from OpenClaw parent processes as an anomaly detection signal indicative of exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Framework AML.T0011 - User Execution AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.5 - AI system security

NIST AI RMF

MS-2.5 - Manage AI risks based on assessed likelihood and impact

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-31999?

OpenClaw, a Windows AI agent framework, contains a current working directory injection flaw in its .cmd/.bat wrapper resolution logic that allows a local attacker with low privileges to execute arbitrary commands by placing a malicious script in an attacker-controlled directory. Although the CVSS score is 6.3 (Medium) and the attack requires high complexity, EPSS places this in the top 85th percentile for exploitation likelihood, and OpenClaw's skills ecosystem was already actively abused to deliver credential-stealing malware (AIID #1368), demonstrating motivated threat actors targeting this exact platform. Successful exploitation corrupts AI agent command execution integrity with High integrity and High availability impact — an attacker can silently redirect tool invocations to arbitrary scripts without any network-level access. Organizations running OpenClaw on Windows should upgrade immediately to version 2026.3.1 and restrict agent process working directories to trusted, non-user-writable paths as a compensating control.

Is CVE-2026-31999 actively exploited?

No confirmed active exploitation of CVE-2026-31999 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31999?

1. Upgrade OpenClaw to version 2026.3.1 immediately — this release eliminates the unsafe CWD fallback during wrapper resolution. 2. If patching is blocked, restrict the process working directory of all OpenClaw invocations to a trusted, non-user-writable system path via process launch configuration or CI/CD job definitions. 3. Apply least-privilege to OpenClaw processes — ensure agents do not run with administrative or elevated privileges to limit blast radius of exploitation. 4. Enable file integrity monitoring on directories where OpenClaw executes to detect unexpected .cmd/.bat files appearing at runtime. 5. Monitor Windows process creation (Event ID 4688 or Sysmon Event ID 1) for .cmd/.bat executions spawned from OpenClaw parent processes as an anomaly detection signal indicative of exploitation.

What systems are affected by CVE-2026-31999?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, CI/CD pipelines, developer workstations, multi-tenant agent platforms.

What is the CVSS score for CVE-2026-31999?

CVE-2026-31999 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksCI/CD pipelinesdeveloper workstationsmulti-tenant agent platforms

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.5

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd manipulation. Remote attackers can exploit improper shell execution fallback mechanisms to achieve command execution integrity loss by controlling the current working directory during wrapper resolution.

Exploitation Scenario

An adversary with local access — or the ability to influence the working directory of an OpenClaw agent session through a poisoned project workspace, a malicious skill package distributed via ClawHub, or a compromised CI/CD job — places a crafted wrapper.cmd file in the expected resolution path. When OpenClaw invokes a tool that triggers the Windows shell fallback mechanism during .cmd/.bat wrapper resolution, the malicious script executes under the agent's process identity instead of the legitimate binary. The attacker gains arbitrary command execution under the agent's context, can modify outputs fed to downstream consumers, and can disrupt availability by terminating the agent process — all without any network-level footprint, consistent with the Local attack vector.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.