Executive brief
OpenClaw is a gateway service deployed on Linux systems that uses systemd for service management. A vulnerability in how environment variables are written to systemd unit files allows local attackers to inject arbitrary system commands by inserting newlines into configuration values. When the service is restarted, these injected commands execute with the privileges of the gateway service user.
Technical details
The vulnerability is a command injection flaw in src/daemon/systemd-unit.ts where the renderEnvLines() function fails to sanitize carriage return (CR) and line feed (LF) characters from environment variable values before writing them to systemd unit files. Additionally, the systemdEscapeArg() function uses an incorrect regex pattern (/[\\s"\\\\]/) that treats \\s as a literal backslash-s instead of a whitespace character class, causing the escaping logic to fail. An attacker who can control config.env.vars can inject newline characters followed by arbitrary systemd directives (e.g., ExecStartPre=). Because systemd parses unit files line-by-line, this breaks out of the Environment= statement and injects new directive lines. When the gateway service is installed, reinstalled, or restarted via systemctl, the injected directives execute as the service user. Exploitation requires local access to influence configuration and trigger a service restart.
Affected products
- OpenClaw openclaw <= 2026.2.19-2
Timeline
- 2026-02-21: disclosed
- 2026-03-03: advisory
- 2026-02-21: patched: Fixed in version 2026.2.21