CVE-2026-31994: OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation
OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.2.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31994?
CVE-2026-31994 is classified as a high severity local command injection vulnerability.
How do I fix CVE-2026-31994?
To fix CVE-2026-31994, update OpenClaw to version 2026.2.19 or later.
What versions are affected by CVE-2026-31994?
CVE-2026-31994 affects all OpenClaw versions prior to 2026.2.19.
What type of vulnerability is CVE-2026-31994?
CVE-2026-31994 is a local command injection vulnerability.
How does CVE-2026-31994 affect Windows scheduled tasks?
CVE-2026-31994 affects Windows scheduled tasks by exploiting unsafe handling of cmd metacharacters.