CVE-2026-31999

MEDIUM

6.3

Descripcion

OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd manipulation. Remote attackers can exploit improper shell execution fallback mechanisms to achieve command execution integrity loss by controlling the current working directory during wrapper resolution.

Detalles CVE

Puntuacion CVSS v3.16.3

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Vector de ataqueLOCAL

ComplejidadHIGH

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/19/2026

Ultima modificacion3/19/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

openclaw:openclaw

Debilidades (CWE)

CWE-78

Referencias

https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openclaw-current-working-directory-injection-via-windows-wrapper-resolution-fallback(disclosure@vulncheck.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.