Executive brief
OpenClaw is a Node.js library that provides controlled command execution with an allowlist feature to restrict which commands can be run. A flaw in the environment variable sanitization allows attackers to override shell startup paths (HOME, ZDOTDIR) and execute arbitrary code before the allowlist-protected command runs, completely bypassing the security controls. An authenticated attacker can achieve remote code execution on systems using this library.
Technical details
The vulnerability is an OS command injection (CWE-78) and external configuration control (CWE-15) in OpenClaw's system.run function. The vulnerability exists because environment sanitization blocks many dangerous keys but fails to block shell-startup-sensitive override keys (HOME and ZDOTDIR). When these variables are overridden by an attacker, shell startup files (.bash_profile, .zshenv) in attacker-controlled paths are executed before the allowlist-evaluated command body runs. The allowlist analysis models only the command body itself, not shell startup side effects. Attack vectors include HOME + bash -lc with malicious .bash_profile and ZDOTDIR + zsh -c with malicious .zshenv. Requires authenticated access to invoke system.run. A fix is available in version 2026.2.22 and later.
Affected products
- OpenClaw openclaw <= 2026.2.21-2
Timeline
- 2026-03-03: disclosed