Vulnerability	Vulnerable Version
M Command Injection @openclaw/lobster is an Adds the lobster agent tool as an optional plugin tool. Affected versions of this package are vulnerable to Command Injection via the fallback process on Windows systems when certain spawn failures occur and `shell: true` is used. An attacker can execute arbitrary commands by supplying crafted arguments that are interpreted by `cmd.exe` if the fallback is triggered. This is only exploitable if the application is running on Windows, the fallback path is triggered (such as by specific spawn errors), and the attacker has control over the arguments passed through a local workflow. How to fix Command Injection? Upgrade `@openclaw/lobster` to version 2026.2.19 or higher.	<2026.2.19

Command Injection

@openclaw/lobster is an Adds the lobster agent tool as an optional plugin tool.

Affected versions of this package are vulnerable to Command Injection via the fallback process on Windows systems when certain spawn failures occur and shell: true is used. An attacker can execute arbitrary commands by supplying crafted arguments that are interpreted by cmd.exe if the fallback is triggered. This is only exploitable if the application is running on Windows, the fallback path is triggered (such as by specific spawn errors), and the attacker has control over the arguments passed through a local workflow.

How to fix Command Injection?

Upgrade @openclaw/lobster to version 2026.2.19 or higher.

<2026.2.19

Go back to all versions of this package