https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:20:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32000 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.</p> https://vulnerability.circl.lu/vuln/cve-2026-32000 https://vulnerability.circl.lu/vuln/ghsa-7fcc-cw49-xm78 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>The Lobster extension tool execution path used a Windows shell fallback (`shell: true`) after spawn failures (`EINVAL`/`ENOENT`). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.17` - Latest confirmed affected published version: `2026.2.17` - Patched version: `2026.2.19`</p> <p>## Technical Details</p> <p>In affected releases (including `v2026.2.17`), `extensions/lobster/src/lobster-tool.ts` retried subprocess launch with `shell: true` on Windows for `EINVAL`/`ENOENT` spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.</p> <p>## Fix Commit(s)</p> <p>- `ba7be018da354ea9f803ed356d20464df0437916`</p> <p>OpenClaw thanks @allsmog for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>The Lobster extension tool execution path used a Windows shell fallback (`shell: true`) after spawn failures (`EINVAL`/`ENOENT`). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.2.17` - Latest confirmed affected published version: `2026.2.17` - Patched version: `2026.2.19`</p> <p>## Technical Details</p> <p>In affected releases (including `v2026.2.17`), `extensions/lobster/src/lobster-tool.ts` retried subprocess launch with `shell: true` on Windows for `EINVAL`/`ENOENT` spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.</p> <p>## Fix Commit(s)</p> <p>- `ba7be018da354ea9f803ed356d20464df0437916`</p> <p>OpenClaw thanks @allsmog for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-7fcc-cw49-xm78