Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 3 | Disclosure2General1 |
| 2026-03-21 | 1 | General1 |
⚡ New CVE Alert: CVE-2026-22176 📊 Severity: 6.1 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-22176 #CVE-2026-22176 #CVE #Medium #CyberSecurity #InfoSec https://t.co/nqvDPyT3Fc
Post summary
The tweet merely highlights CVE-2026-22176 with basic severity and impact metrics but provides no actionable details, exploitation evidence, or mitigation steps.
CVE Alert: CVE-2026-22176 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-22176-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-22176 #openclaw #
Post summary
The post is a brief alert announcing CVE‑2026‑22176 for OpenClaw, but it provides no technical details, PoC, or evidence of exploitation.
CVE-2026-22176 Command Injection Vulnerability in OpenClaw Scheduled Task Script Generation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22176
Post summary
The text announces a command injection vulnerability in OpenClaw's scheduled task script generation, providing minimal technical detail but no evidence of exploitation, PoC, patch, or false‑positive claims.
CVE-2026-22176 OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to … https://www.cve.org/CVERecord?id=CVE-2026-22176
Post summary
The entry announces a command injection vulnerability (CVE‑2026‑22176) in OpenClaw versions pre‑2026.2.19, affecting Windows Scheduled Task script generation, with no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |