cve.bz

CVE-2026-31999

5.8 mediumEPSS 0.3%

Medium (5.8) in openclaw openclaw. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.1.

OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attackers to influence execution behavior through cwd manipulation. Remote attackers can exploit improper shell execution fallback mechanisms to achieve command execution integrity loss by controlling the current working directory during wrapper resolution.

Severity

CVSS 4.0

5.8 medium
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE
CWE-78
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6f6j-wx9w-ff4jnpmopenclaw>=2026.2.26 <2026.3.12026.3.1

References

Check your stackJSON