Executive brief
Clawdbot is a Docker-based command execution sandbox used for safe, isolated execution of untrusted code. A vulnerability in its environment variable handling allows authenticated users to inject arbitrary commands when Docker sandbox mode is enabled, potentially leading to exposure of sensitive container data and unauthorized code execution. Organizations using Clawdbot for code execution isolation are at risk of sandbox escape.
Technical details
The vulnerability is an OS command injection flaw (CWE-78) in Clawdbot's Docker sandbox execution mechanism, caused by unsafe handling of the PATH environment variable when constructing shell commands. An authenticated attacker can control environment variables supplied to the container, allowing them to influence command execution within the sandbox context. The attack requires network access and valid authentication credentials, but no user interaction. Successful exploitation enables arbitrary command execution, container filesystem access, environment variable disclosure, and potential privilege escalation in misconfigured environments. A patch was released in version 2026.1.29; all versions up to 2026.1.24 are affected.
Affected products
- OpenClaw Clawdbot <= 2026.1.24
Timeline
- 2026-02-02: disclosed
- 2026-01-31: patched: Patched in version 2026.1.29