GHSA-pj5x-38rw-6fph: OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation

March 3, 2026

A command injection vulnerability existed in Windows Scheduled Task script generation for OpenClaw. Environment values were written into gateway.cmd using unquoted set KEY=VALUE, which allowed Windows shell metacharacters in config-provided environment variables to break out of assignment context.

References

github.com/advisories/GHSA-pj5x-38rw-6fph
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/dafe52e8cf1a041d898cfb304a485fa05e5f58fb
github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph

Code Behaviors & Features

Detect and mitigate GHSA-pj5x-38rw-6fph with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →