Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/openclaw@2026.1.21
purl pkg:npm/openclaw@2026.1.21
Tags Ghost
Next non-vulnerable version 2026.4.23
Latest non-vulnerable version 2026.4.23
Risk 4.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-2t1z-v6qm-gkhb
Aliases:
GHSA-8px5-2gfr-7ph6
Duplicate Advisory: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fg3m-vhrr-8gj6. This link is maintained to preserve external references. ## Original Description OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inject arbitrary commands through tool-provided arguments. When spawn failures trigger shell fallback with shell: true, attackers can exploit cmd.exe command interpretation to execute malicious commands by controlling workflow arguments.
2026.2.19-1
Affected by 484 other vulnerabilities.
VCID-ct6t-c3vp-4ydg
Aliases:
CVE-2026-32015
GHSA-g75x-8qqm-2vxp
OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks `tools.exec.safeBins` allowlist checks could be bypassed by PATH-hijacked binaries, allowing execution of attacker-controlled trojan binaries under an allowlisted executable name.
2026.2.19
Affected by 464 other vulnerabilities.
VCID-xrcg-kjac-nyeb
Aliases:
CVE-2026-31995
GHSA-fg3m-vhrr-8gj6
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path On Windows, the Lobster extension previously retried certain spawn failures (`ENOENT`/`EINVAL`) with `shell: true` for wrapper compatibility. In that fallback path, tool-provided arguments could be interpreted by `cmd.exe` if fallback was triggered.
2026.2.19
Affected by 464 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-07T20:51:59.482803+00:00 GHSA Importer Affected by VCID-2t1z-v6qm-gkhb https://github.com/advisories/GHSA-8px5-2gfr-7ph6 38.6.0
2026-06-07T03:17:16.355139+00:00 GitLab Importer Affected by VCID-2t1z-v6qm-gkhb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-8px5-2gfr-7ph6.yml 38.6.0
2026-06-05T22:02:50.504461+00:00 GHSA Importer Affected by VCID-xrcg-kjac-nyeb https://github.com/advisories/GHSA-fg3m-vhrr-8gj6 38.6.0
2026-06-05T22:02:44.137544+00:00 GHSA Importer Affected by VCID-ct6t-c3vp-4ydg https://github.com/advisories/GHSA-g75x-8qqm-2vxp 38.6.0
2026-06-02T04:51:13.483347+00:00 GitLab Importer Affected by VCID-ct6t-c3vp-4ydg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/CVE-2026-32015.yml 38.6.0
2026-06-02T04:51:13.157995+00:00 GitLab Importer Affected by VCID-xrcg-kjac-nyeb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/CVE-2026-31995.yml 38.6.0