https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:08:39.537149+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05004 bdu:2026-05004 2026-10-03T16:08:39.698871+00:00 bdu:2026-05004 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-32000 BREW-openclaw-cli-CVE-2026-32000 — OpenClaw has command injection via Windows shell fallback in Lobster tool execution 2026-10-03T16:08:39.698916+00:00

Affected: Homebrew: openclaw-cli

## Summary

The Lobster extension tool execution path used a Windows shell fallback (`shell: true`) after spawn failures (`EINVAL`/`ENOENT`). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<= 2026.2.17` - Latest confirmed affected published version: `2026.2.17` - Patched version: `2026.2.19`

## Technical Details

In affected releases (including `v2026.2.17`), `extensions/lobster/src/lobster-tool.ts` retried subprocess launch with `shell: true` on Windows for `EINVAL`/`ENOENT` spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.

## Fix Commit(s)

- `ba7be018da354ea9f803ed356d20464df0437916`

OpenClaw thanks @allsmog for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-329397 EUVD-2026-329397 2026-10-03T16:08:39.698991+00:00 EUVD-2026-329397 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32000 fkie_cve-2026-32000 2026-10-03T16:08:39.699015+00:00

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.

 https://cve.radiocsirt.org/vuln/ghsa-7fcc-cw49-xm78 GHSA-7fcc-cw49-xm78 — OpenClaw has command injection via Windows shell fallback in Lobster tool execution 2026-10-03T16:08:39.699056+00:00

Affected: npm: openclaw

## Summary

The Lobster extension tool execution path used a Windows shell fallback (`shell: true`) after spawn failures (`EINVAL`/`ENOENT`). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.

## Affected Packages / Versions

- Package: `openclaw` (npm) - Affected versions: `<= 2026.2.17` - Latest confirmed affected published version: `2026.2.17` - Patched version: `2026.2.19`

## Technical Details

In affected releases (including `v2026.2.17`), `extensions/lobster/src/lobster-tool.ts` retried subprocess launch with `shell: true` on Windows for `EINVAL`/`ENOENT` spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.

## Fix Commit(s)

- `ba7be018da354ea9f803ed356d20464df0437916`

OpenClaw thanks @allsmog for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0472 WID-SEC-W-2026-0472 — OpenClaw: Mehrere Schwachstellen 2026-10-03T16:08:39.699108+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.