Количество 3
Количество 3
CVE-2026-22176
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.
GHSA-pj5x-38rw-6fph
OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
BDU:2026-05027
Уязвимость сценария src/daemon/schtasks.ts ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольные команды
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-22176 OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed. | CVSS3: 6.1 | 1% Низкий | 5 месяцев назад |
| GHSA-pj5x-38rw-6fph OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation | 1% Низкий | 5 месяцев назад | |
 | BDU:2026-05027 Уязвимость сценария src/daemon/schtasks.ts ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольные команды | CVSS3: 7.8 | 1% Низкий | 6 месяцев назад |
Уязвимостей на страницу