Executive brief
OpenClaw is a library used to execute system commands with security controls. The product failed to properly sanitize environment variable assignments when passed through shell commands or the env wrapper, allowing attackers to inject dangerous shell variables (like SHELLOPTS and PS4) that could lead to arbitrary command execution.
Technical details
This is an OS command injection vulnerability (CWE-78) in OpenClaw's exec preflight handling. The root cause is two-fold: (1) shell-wrapper detection only activated for inline `-c`/`-lc` payload patterns (when `shellPayload !== null`), leaving direct shell invocations like `sh script.sh` unprotected; (2) dangerous environment variables embedded as `VAR=val` arguments to the `env` dispatch wrapper bypassed the override sanitizer entirely. An unauthenticated attacker with network access can inject high-risk shell variables such as SHELLOPTS and PS4 through argv-level environment assignment forms, affecting command execution semantics and achieving arbitrary command execution. The vulnerability was fixed in version 2026.4.12 by broadening shell-wrapper detection to cover all shell invocations and adding extraction/validation of environment assignment keys from dispatch-wrapper argv.
Affected products
- OpenClaw openclaw >= 2026.2.22 < 2026.4.12
Timeline
- 2026-04-17: disclosed
- 2026-04-13: patched: Fixed in PR #65717; v2026.4.12 is the first stable release containing the fix