Количество 3
Количество 3
CVE-2026-31994
OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context.
GHSA-mqr9-vqhq-3jxw
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
BDU:2026-05008
Уязвимость сценария src/daemon/schtasks.ts ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольные команды
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-31994 OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context. | CVSS3: 7.1 | 1% Низкий | 5 месяцев назад |
| GHSA-mqr9-vqhq-3jxw OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling | 1% Низкий | 5 месяцев назад | |
 | BDU:2026-05008 Уязвимость сценария src/daemon/schtasks.ts ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю выполнить произвольные команды | CVSS3: 7.8 | 1% Низкий | 6 месяцев назад |
Уязвимостей на страницу