Executive brief
OpenClaw is a personal AI assistant library. A vulnerability in its environment handling allows a local attacker to execute malicious code by tricking the software into using a fake system shell. This could lead to a full compromise of the application's process and the data it handles.
Technical details
The OpenClaw npm package contains a vulnerability in its `shell-env` component where it incorrectly validates the system shell path. The software would execute any binary located in a set of 'trusted' hardcoded prefixes (such as /opt/homebrew/bin) if the $SHELL environment variable pointed there, even if the shell was not listed in /etc/shells. In environments where these directories are writable by a user, an attacker can place a malicious binary and influence the $SHELL variable to achieve arbitrary code execution in the context of the OpenClaw process. The vulnerability is fixed in version 2026.2.23 by strictly enforcing that shells must be registered in /etc/shells.
Affected products
- OpenClaw openclaw >= 2026.2.22, <= 2026.2.22-2
Timeline
- 2026-02-24: disclosed
- 2026-03-03: advisory: GitHub Advisory published
- 2026-02-24: patched