CVE-2026-31994Disclosure(microsoft / openclaw)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and expansion-sensitive characters in gateway.cmd files. Local attackers with control over service script generation arguments can inject arbitrary commands by providing metacharacter-only values or CR/LF sequences that execute unintended code in the scheduled task context.

microsoft CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openclaw/openclaw/commit/280c6b117b2f0e24f398e5219048cd4cc3b82396

Vendor / third-party advisories

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw
windows

Threat summary

5 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-03-19); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

microsoft openclaw

Products

openclawwindows

1 version affected across 2 products

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Disclosure

480.0%

General

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-19	4	Disclosure3General1
2026-03-20	1	Disclosure1

Full discourse5 posts

RedPacket Security@RedPacketSec205d
General
CVE Alert: CVE-2026-31994 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-31994-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-31994 #openclaw #
Post summary
The tweet only references a CVE alert link for CVE-2026-31994 without providing detailed technical or exploitation information.
1000083
3.6K followersView on X
CVEarity@CVEarity204d
Disclosure
⚡ New CVE Alert: CVE-2026-31994 📊 Severity: 7.1 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-31994 #CVE-2026-31994 #CVE #High #CyberSecurity #InfoSec https://t.co/KnHgYY191G
Post summary
The tweet announces CVE-2026-31994, highlighting its severity of 7.1 and high risk level, but provides no technical, exploit, or patch details.
0000029
108 followersView on X
VulnTracker@vuln_tracker204d
Disclosure
🚨 6 high-severity CVEs dropped today for OpenClaw - the popular AI automation platform CVE-2026-28461 (7.5) - Memory exhaustion via webhook CVE-2026-31989 (7.4) - SSRF via web_search CVE-2026-27566 (7.1) - Allowlist bypass CVE-2026-31992 (7.1) - Exec-guard bypass CVE-2026-31994 (7.1) - Command injection CVE-2026-31998 (7.0) - Auth bypass Popular platforms = bigger targets. Track everything: http://vulntracker.io
Post summary
A Tweet announces six newly disclosed, high‑severity CVEs for OpenClaw, offering CVSS scores and brief vulnerability descriptors, but no proof of concept, active exploitation, patch details, or false‑positive claims.
00000124
433 followersView on X
CVE@CVEnew205d
Disclosure
CVE-2026-31994 OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacha… https://www.cve.org/CVERecord?id=CVE-2026-31994
Post summary
OpenClaw versions prior to 2026.2.19 are vulnerable to local command injection through unsafe handling of cmd meta characters in scheduled task script generation, with no PoC, exploit, or patch mentioned.
0000093
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds205d
Disclosure
CVE-2026-31994 Local Command Injection in OpenClaw Windows Scheduled Task Script Generation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31994
Post summary
The entry announces CVE-2026-31994, a local command injection flaw in OpenClaw’s Windows scheduled task script generation. No PoC, exploit code, patch information, or active exploitation evidence is provided.
0000040
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows	-	-	-
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard microsoft CVEs openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-31994

VulnTracker[verified]@vuln_trackerDisclosure

A Tweet announces six newly disclosed, high‑severity CVEs for OpenClaw, offering CVSS scores and brief vulnerability descriptors, but no proof of concept, active exploitation, patch details, or false‑positive claims.

RedPacket Security@RedPacketSecGeneral

The tweet only references a CVE alert link for CVE-2026-31994 without providing detailed technical or exploitation information.

CVEarity@CVEarityDisclosure

The tweet announces CVE-2026-31994, highlighting its severity of 7.1 and high risk level, but provides no technical, exploit, or patch details.

CVE@CVEnewDisclosure

OpenClaw versions prior to 2026.2.19 are vulnerable to local command injection through unsafe handling of cmd meta characters in scheduled task script generation, with no PoC, exploit, or patch mentioned.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The entry announces CVE-2026-31994, a local command injection flaw in OpenClaw’s Windows scheduled task script generation. No PoC, exploit code, patch information, or active exploitation evidence is provided.