Executive brief
OpenClaw is a tool used for managing AI agent sessions and workspace configurations. A vulnerability exists where a malicious workspace configuration can inject dangerous system variables when starting a session. If an operator opens a compromised workspace, an attacker could execute unauthorized code on the operator's machine, potentially leading to full system compromise or data theft.
Technical details
OpenClaw versions prior to 2026.4.20 are vulnerable to an uncontrolled search path and environment variable injection flaw. The Model Context Protocol (MCP) stdio server implementation fails to sanitize environment variables provided in workspace configurations. An attacker can craft a malicious workspace that sets dangerous variables such as 'NODE_OPTIONS', 'LD_PRELOAD', or 'BASH_ENV'. When a user initiates a session within this workspace, the spawned child process inherits these variables, allowing the attacker to load and execute arbitrary code. This vulnerability is addressed in version 2026.4.20 by implementing a safety denylist for environment entries before process spawning.
Affected products
- OpenClaw openclaw < 2026.4.20
Timeline
- 2026-04-21: disclosed: Vulnerability reported to OpenClaw
- 2026-04-25: advisory: GitHub Advisory published
- 2026-04-20: patched: Fixed in version 2026.4.20