Executive brief
OpenClaw is a tool for managing and executing skills. The applySkillConfigEnvOverrides function failed to properly filter dangerous environment variables before applying them to the host process, allowing an attacker with local filesystem access to inject variables like NODE_OPTIONS that can influence runtime behavior and child process execution.
Technical details
The vulnerability exists in the applySkillConfigEnvOverrides function, which copied environment variable overrides from skill configuration files directly into process.env without applying safety policies to filter dangerous host-level variables. This is a code injection vulnerability (CWE-94) combined with improper system configuration control (CWE-15). An attacker with the ability to modify local OpenClaw configuration files (such as ~/.openclaw/openclaw.json) can inject dangerous process-level variables like NODE_OPTIONS into the host environment. The fix, released in version 2026.2.21, implements sanitization and blocklisting of dangerous host environment keys before applying any overrides, with regression tests included.
Affected products
- OpenClaw OpenClaw < 2026.2.21
Timeline
- 2026-02-27: disclosed
- 2026-02-21: patched: Fixed in version 2026.2.21