CVE-2026-32000

OpenClaw before version 2026.2.19 has a command injection flaw in the Lobster extension tool execution that uses a Windows shell fallback (shell: true) after spawn failures. An attacker can inject shell metacharacters into command arguments to run arbitrary commands when subprocess launch fails w...