CVE-2026-22176— OpenClaw 操作系统命令注入漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-22176の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
OpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation
ソース: NVD (National Vulnerability Database)
脆弱性説明
OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd using unquoted set KEY=VALUE assignments, allowing shell metacharacters to break out of assignment context. Attackers can inject arbitrary commands through environment variable values containing metacharacters like &, |, ^, %, or ! to achieve command execution when the scheduled task script is generated and executed.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
OpenClaw 操作系统命令注入漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.2.19之前版本存在操作系统命令注入漏洞，该漏洞源于Windows计划任务脚本生成中存在命令注入，环境变量使用未加引号的set KEY=VALUE赋值写入gateway.cmd，允许shell元字符突破赋值环境，攻击者可通过包含特殊元字符的环境变量值注入任意命令。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-22176の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-22176のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · OpenClaw · 2026-03-19 · 60 CVEs total
| CVE-2026-32038 | 9.8 CRITICAL | OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter |
| CVE-2026-32013 | 8.8 HIGH | OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods |
| CVE-2026-31998 | 8.6 HIGH | OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty al |
| CVE-2026-32034 | 8.1 HIGH | OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP |
| CVE-2026-32014 | 8.0 HIGH | OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields |
| CVE-2026-32016 | 7.8 HIGH | OpenClaw < 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOS |
| CVE-2026-32032 | 7.8 HIGH | OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variabl |
| CVE-2026-32015 | 7.8 HIGH | OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Va |
| CVE-2026-32025 | 7.5 HIGH | OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication By |
| CVE-2026-32030 | 7.5 HIGH | OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal |
| CVE-2026-28461 | 7.5 HIGH | OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn |
| CVE-2026-32011 | 7.5 HIGH | OpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing |
| CVE-2026-31989 | 7.4 HIGH | OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect |
| CVE-2026-32019 | 7.4 HIGH | OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard |
| CVE-2026-32023 | 7.1 HIGH | OpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in s |
| CVE-2026-32000 | 7.1 HIGH | OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execut |
| CVE-2026-31992 | 7.1 HIGH | OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S |
| CVE-2026-27566 | 7.1 HIGH | OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run |
| CVE-2026-28460 | 7.1 HIGH | OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution i |
| CVE-2026-32017 | 7.1 HIGH | OpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlist |
Showing 20 of 60 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: OpenClaw
- CVE-2026-44118
OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Tok - CVE-2026-44117
OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot - CVE-2026-44116
OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo P - CVE-2026-44115
OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted He - CVE-2026-44114
OpenClaw < 2026.4.20 - Environment Variable Namespace Collis
同じベンダー: OpenClaw
- CVE-2026-44118
OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Tok - CVE-2026-44117
OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot - CVE-2026-44116
OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo P - CVE-2026-44115
OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted He - CVE-2026-44114
OpenClaw < 2026.4.20 - Environment Variable Namespace Collis
同じ弱点: CWE-78
- CVE-2026-8273
D-Link DNS-320 system_mgr.cgi cgi_merge_user os command inje - CVE-2026-8272
D-Link DNS-320 webfile_mgr.cgi chown os command injection - CVE-2026-8271
D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command inje - CVE-2026-8265
Tenda AC6 httpd getLogFile get_log_file os command injection - CVE-2026-8264
Tenda AC6 httpd WifiApScan formWifiApScan os command injecti
V. CVE-2026-22176へのコメント
まだコメントはありません