CVE-2026-22176: OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
(updated )
A command injection vulnerability existed in Windows Scheduled Task script generation for OpenClaw. Environment values were written into gateway.cmd using unquoted set KEY=VALUE, which allowed Windows shell metacharacters in config-provided environment variables to break out of assignment context.
References
- github.com/advisories/GHSA-pj5x-38rw-6fph
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fb
- github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph
- nvd.nist.gov/vuln/detail/CVE-2026-22176
- www.vulncheck.com/advisories/openclaw-command-injection-via-unescaped-environment-variables-in-windows-scheduled-task
Code Behaviors & Features
Detect and mitigate CVE-2026-22176 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →