Executive brief
OpenClaw is a Node.js library used for running automated tasks and executing host commands. A vulnerability in its environment variable handling allows attackers who can control configuration or environment inputs to inject malicious shell startup files, leading to arbitrary code execution before intended commands run. Exploitation requires local or privileged access to the application's configuration or environment.
Technical details
This vulnerability is an OS command injection flaw (CWE-78) and external control of system configuration (CWE-15) arising from insufficient sanitization of BASH_ENV, ENV, BASH_FUNC_*, LD_*, and DYLD_* environment variables before they are passed to spawned shell commands. The root cause is that attacker-controlled environment values are admitted into the process environment and inherited by host command execution paths without proper filtering. An attacker with local or privileged influence over configuration or environment inputs can inject these dangerous variables to achieve pre-command shell execution. The fix hardens environment handling across config env ingestion, node-host inherited environment sanitization, and macOS execution paths by blocking dangerous startup/runtime env keys and prefixes. Patches are available in version 2026.2.21 and later.
Affected products
- OpenClaw openclaw <= 2026.2.19-2
Timeline
- 2026-03-03: disclosed: GitHub Security Advisory GHSA-w9cg-v44m-4qv8 published
- 2026-02-21: patched: Security fix committed to main branch (2cdbadee1f8fcaa93302d7debbfc529e19868ea4)
- 2026-03-03: other: Planned patched release version 2026.2.21