CVE-2026-31999: Openclaw RCE Vulnerability

CVE-2026-31999 Overview

CVE-2026-31999 is a current working directory (CWD) injection vulnerability affecting OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows systems. The vulnerability exists in the wrapper resolution mechanism for .cmd and .bat files, allowing attackers to manipulate execution behavior through CWD manipulation. This command injection flaw (CWE-78) enables attackers to exploit improper shell execution fallback mechanisms to achieve command execution integrity loss by controlling the current working directory during wrapper resolution.

Critical Impact

Attackers can manipulate the current working directory during wrapper resolution to inject malicious commands, potentially leading to arbitrary command execution and integrity loss on affected Windows systems.

Affected Products

• OpenClaw versions 2026.2.26 to 2026.3.0 (Node.js package)
• OpenClaw on Windows platforms with .cmd/.bat wrapper resolution
• Systems utilizing OpenClaw's shell execution fallback mechanisms

Discovery Timeline

• 2026-03-19 - CVE-2026-31999 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-31999

Vulnerability Analysis

This vulnerability stems from improper handling of the current working directory when OpenClaw resolves wrapper files (.cmd and .bat) on Windows systems. The shell execution fallback mechanism fails to properly validate or sanitize the CWD context, creating an attack surface where malicious actors can influence which executables or scripts are loaded during wrapper resolution.

The attack requires local access and specific conditions to be met, as the attacker must be able to control or manipulate the current working directory at the time wrapper resolution occurs. When successfully exploited, the vulnerability can result in high integrity and availability impact, allowing attackers to execute arbitrary commands within the context of the affected application.

Root Cause

The root cause is improper input validation (CWE-78: OS Command Injection) in the wrapper resolution logic. When OpenClaw attempts to resolve .cmd or .bat wrapper files on Windows, it does not adequately validate the current working directory context. This allows an attacker who can influence the CWD to inject malicious files that will be executed during the resolution fallback process, bypassing intended execution paths.

Attack Vector

The attack leverages the local attack vector where an attacker with low privileges can manipulate the current working directory before OpenClaw's wrapper resolution occurs. The exploitation flow involves:

1. An attacker places a malicious .cmd or .bat file in a directory they control
2. The attacker manipulates the application or environment to change the CWD to their controlled directory
3. When OpenClaw performs wrapper resolution, the fallback mechanism incorrectly resolves to the attacker's malicious file
4. The malicious script executes with the privileges of the OpenClaw process

The vulnerability mechanism exploits the Windows shell execution fallback behavior. When the normal wrapper resolution path fails or falls back, the system searches for executable files in a manner that can be influenced by the current working directory. An attacker who can control this directory can place specially crafted batch files that will be executed instead of legitimate wrappers. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-31999

Indicators of Compromise

• Unexpected .cmd or .bat files appearing in application working directories
• Anomalous process spawning from OpenClaw-related processes on Windows
• Unusual changes to the current working directory prior to OpenClaw execution
• Process execution chains showing batch file execution from non-standard locations

Detection Strategies

• Monitor for .cmd/.bat file creation or modification in directories associated with OpenClaw operations
• Implement process monitoring to detect unexpected child processes spawned by Node.js or OpenClaw processes
• Deploy file integrity monitoring on OpenClaw installation directories and common working directories
• Analyze Windows event logs for suspicious command interpreter invocations following OpenClaw execution

Monitoring Recommendations

• Enable command-line auditing on Windows systems to capture full process command lines
• Configure SentinelOne endpoint protection to monitor for CWD manipulation patterns
• Set up alerts for batch file execution from user-writable directories in OpenClaw contexts
• Review process creation events for anomalous execution chains involving cmd.exe or wrapper scripts

How to Mitigate CVE-2026-31999

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.1 or later immediately
• Audit systems for any evidence of exploitation, including unexpected batch files in working directories
• Review and restrict write permissions on directories where OpenClaw operates
• Implement application whitelisting to prevent unauthorized script execution

Patch Information

The OpenClaw development team has addressed this vulnerability in version 2026.3.1. Organizations should update to this version or later to remediate the CWD injection vulnerability. Detailed patch information is available in the GitHub Security Advisory. Additional technical context can be found in the VulnCheck Advisory.

Workarounds

• Restrict write access to all directories that may serve as the current working directory during OpenClaw operations
• Implement strict directory permissions to prevent unauthorized file creation in OpenClaw-related paths
• Consider running OpenClaw processes from fixed, protected directories with controlled CWD settings
• Deploy endpoint detection solutions to monitor for suspicious batch file execution patterns

# Restrict write permissions on OpenClaw working directories (Windows)
icacls "C:\path\to\openclaw" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)(W,AD)"

# Verify OpenClaw version
npm list openclaw

# Update OpenClaw to patched version
npm update openclaw@2026.3.1