Openclaw cli: OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling (CVE-2026-31994)

The vulnerability in OpenClaw CLI affects Windows daemon startup script generation by improperly quoting and escaping command-line arguments in generated scheduled task scripts (gateway.cmd). Specifically, cmd metacharacter-only values can be injected without safe quoting or escaping, and CR/LF characters are not properly guarded against, leading to possible local command injection when the scheduled task executes. The fix involves separating argument quoting for schtasks and batch scripts, quoting metacharacter arguments, escaping expansion characters (% and !), rejecting CR/LF in command arguments and environment assignments, and adding regression tests.

This vulnerability allows a local attacker with control over values used in service script generation (such as install-time or runtime arguments or environment variables) on Windows systems to execute unintended commands in the context of the scheduled task. This could lead to privilege escalation or unauthorized code execution locally on affected systems.

A patch is available in OpenClaw CLI version 2026.2.19 and later. Users should upgrade to this version or newer to remediate the vulnerability. Until the patch is applied, avoid supplying untrusted or metacharacter-containing arguments to the service script generation process. No additional vendor advisory states that no action is required.