CVE-2026-32000 OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution

🗓️ 19 Mar 2026 01:00:57Reported by GoogleType

osv🔗 osv.dev👁 6 Views

Command injection in Windows Lobster extension via shell fallback after spawn failures; exploits metacharacters in subprocess launch.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-32000	19 Mar 202601:00	–	attackerkb
BDU FSTEC	The vulnerability in the extensions/lobster/src/lobster-tool.ts script of the AI agent OpenClaw (previously known as ClawdBot or MoltBot) allows a violator to execute arbitrary commands.	13 Apr 202600:00	–	bdu_fstec
CNNVD	OpenClaw 操作系统命令注入漏洞	19 Mar 202600:00	–	cnnvd
CVE	CVE-2026-32000	19 Mar 202601:00	–	cve
Cvelist	CVE-2026-32000 OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution	19 Mar 202601:00	–	cvelist
EUVD	EUVD-2026-13039	19 Mar 202603:30	–	euvd
Github Security Blog	Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes	19 Mar 202603:30	–	github
Github Security Blog	OpenClaw has command injection via Windows shell fallback in Lobster tool execution	3 Mar 202618:09	–	github
NVD	CVE-2026-32000	19 Mar 202602:16	–	nvd
OSV	GHSA-5RP4-CWGH-GVWQ Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes	19 Mar 202603:30	–	osv

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32000.json
github	www.github.com/openclaw/openclaw/security/advisories/GHSA-7fcc-cw49-xm78
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-32000
vulncheck	www.vulncheck.com/advisories/openclaw-command-injection-via-windows-shell-fallback-in-lobster-tool-execution
github	www.github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916

15 Jul 2026 01:48Current

7.4High risk

Vulners AI Score7.4

CVSS 45.8

EPSS0.00618