CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
Impact
### Summary On Windows nodes, exec requests were executed via `cmd.exe /d /s /c <rawCommand>`. In allowlist/approval-gated mode, the allowlist analysis did not model Windows `cmd.exe` parsing and metacharacter behavior. A crafted command string could cause `cmd.exe` to interpret additional operations (for example command chaining via `&`, or expansion via `%...%` / `!...!`) beyond what was allowlisted/approved. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.1` - Patched: `>= 2026.2.2` - Latest (npm) as of 2026-02-14: `2026.2.13` ### Details - Default installs: Not affected unless you opt into exec allowlist/approval gating on Windows nodes. - Windows execution uses `cmd.exe` via `src/infra/node-shell.ts`. - The fix hardens Windows allowlist enforcement by: - Passing the platform into allowlist analysis and rejecting Windows shell metacharacters. - Treating `cmd.exe` invocation as not allowlist-safe on Windows. - Avoiding `cmd.exe` entirely in allowlist mode by executing the parsed argv directly when possible. ### Fix Commit(s) - `a7f4a53ce80c98ba1452eb90802d447fca9bf3d6` Thanks @simecek for reporting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | < 2026.2.2 | 2026.2.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/openclaw/openclaw/commit/a7f4a53ce80c98ba1452eb90802d447fca9bf3d6
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qj77-c3c8-9c3q
- https://www.vulncheck.com/advisories/openclaw-command-injection-via-cmdexe-parsing-bypass-in-allowlist-enforcement
- https://github.com/advisories/GHSA-qj77-c3c8-9c3q
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-28391