Executive brief
OpenClaw is a local AI assistant that executes build commands on behalf of users. The tool failed to filter four hostile environment variables (HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, MAKEFLAGS) that can be manipulated by attackers to inject arbitrary commands into build tool execution, resulting in remote code execution with user privileges.
Technical details
The vulnerability is an incomplete environment variable denylist (CWE-184) leading to OS command injection (CWE-78). OpenClaw maintains a security boundary by sanitizing environment variables before executing build commands, but it omitted four critical build-tool configuration variables (HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, MAKEFLAGS) from its denylist. An attacker can set these variables in the local environment to influence how build tools (Mercurial, Rust Cargo, Make) execute, allowing arbitrary command injection. The attack vector is local with no privilege or authentication requirements, scoped to the OpenClaw user's execution context. The fix was patched in version 2026.4.8 and verified with commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
Affected products
- OpenClaw OpenClaw < 2026.4.8
Timeline
- 2026-04-09: disclosed