PT-2026-25440

Published

2026-03-03

·

Updated

2026-03-03

Description by

CVSS 4.0
8.6
High
MetricsAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

The Lobster extension tool execution path used a Windows shell fallback (shell: true) after spawn failures (EINVAL/ENOENT). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.17
  • Latest confirmed affected published version: 2026.2.17
  • Patched version: 2026.2.19

Technical Details

In affected releases (including v2026.2.17), extensions/lobster/src/lobster-tool.ts retried subprocess launch with shell: true on Windows for EINVAL/ENOENT spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.

Fix Commit(s)

  • ba7be018da354ea9f803ed356d20464df0437916
OpenClaw thanks @allsmog for reporting.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')
Related identifiers
GHSA-7FCC-CW49-XM78
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com