CVE-2026-31999: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-31999 is a current working directory (CWD) injection vulnerability in OpenClaw affecting versions 2026.2.26 through 2026.3.0 on Windows. The flaw exists in the ACPX Windows wrapper resolution mechanism for .cmd/.bat files, where improper shell execution fallback allows attackers to influence command execution behavior by controlling the current working directory. It was disclosed on March 19, 2026, with a patch available in version 2026.3.1. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), arising from OpenClaw's ACPX wrapper resolution logic on Windows. When resolving .cmd or .bat wrappers, the software falls back to shell execution without adequately constraining the working directory, allowing an attacker who controls the CWD to substitute or influence which executable is resolved and run. The fix in version 2026.3.1 enforces explicit PATH/PATHEXT-based entrypoint resolution and unwrapped Node/EXE execution, with strict fail-closed handling for unresolvable wrapper cases (GitHub Advisory). The vulnerability is specific to Windows ACPX configurations and does not affect other platforms.

Successful exploitation results in command execution integrity loss, where an attacker can cause unintended commands or binaries to be executed in place of the intended wrapper. This affects confidentiality, integrity, and availability — CVSS v3.1 rates all three impacts as High. An attacker with local access and low privileges could leverage this to escalate privileges, execute arbitrary code, or disrupt service availability on affected Windows systems running OpenClaw (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (VulnCheck). The EPSS score is approximately 0.071%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to control the current working directory during wrapper resolution, limiting the attack surface.

1. Identify target: Locate a Windows system running OpenClaw versions 2026.2.26 through 2026.3.0 with ACPX paths configured.
2. Gain local access: Obtain low-privileged local access to the target system (e.g., via a standard user account or existing foothold).
3. Control the current working directory: Place a malicious .cmd or .bat file with the same name as a legitimate wrapper expected by OpenClaw into a directory the attacker controls.
4. Trigger wrapper resolution: Cause OpenClaw to invoke the wrapper resolution mechanism (e.g., by triggering a relevant operation or process that invokes the ACPX wrapper lookup) while the CWD is set to the attacker-controlled directory.
5. Achieve code execution: The shell execution fallback resolves the wrapper from the attacker-controlled CWD instead of the intended PATH/PATHEXT location, executing the malicious script with the privileges of the OpenClaw process (GitHub Advisory).

• File System: Unexpected .cmd or .bat files placed in directories that may be used as the current working directory during OpenClaw execution; files with names matching known OpenClaw wrapper scripts in non-standard locations.
• Process: Unusual child processes spawned by the OpenClaw Node.js process, particularly cmd.exe or powershell.exe executing scripts from unexpected directories.
• Logs: OpenClaw or system logs showing wrapper resolution failures or unexpected shell fallback events; Windows Event Logs (Event ID 4688) recording process creation with unexpected parent-child relationships involving OpenClaw.
• File System: Newly created or modified .cmd/.bat files in writable directories accessible to the OpenClaw process.

Upgrade OpenClaw to version 2026.3.1 or later, which enforces explicit PATH/PATHEXT-based entrypoint resolution and disables the vulnerable shell execution fallback by default (GitHub Advisory). As a temporary workaround, restrict write access to directories that may be used as the current working directory during OpenClaw execution to prevent placement of malicious wrapper files. Organizations should prioritize patching Windows systems running affected OpenClaw versions (2026.2.26 through 2026.3.0) in ACPX configurations.

The vulnerability was reported by researcher tdjackey and published by steipete via the GitHub Security Advisory (GitHub Advisory). RedPacketSecurity flagged the CVE alert on social media shortly after disclosure (RedPacketSecurity). No broader media coverage or significant community debate has been observed beyond standard vulnerability aggregator postings.