Executive brief
OpenClaw is a framework for building autonomous AI agents and applications. The Skill Env Handler component fails to properly sanitize environment variable overrides, allowing an attacker who can modify local configuration files to inject dangerous process-level variables like NODE_OPTIONS. This could allow code execution or influence application runtime behavior.
Technical details
The applySkillConfigEnvOverrides function in OpenClaw 2026.2.19-2 and earlier fails to apply host environment safety policies when copying skill configuration environment variables into the host process.env. This is a code injection vulnerability (CWE-94) combined with improper system configuration control (CWE-15). An attacker with local file system access to modify ~/.openclaw/openclaw.json or similar state files can inject dangerous environment variables such as NODE_OPTIONS, which influence Node.js runtime and child process behavior. The fix in version 2026.2.21 sanitizes skill env overrides and blocks dangerous host env keys before application. Attack vector is network-accessible if the local config can be modified remotely, but typically requires local access.
Affected products
- OpenClaw OpenClaw <=2026.2.19-2
Timeline
- 2026-02-21: disclosed
- 2026-02-21: patched: Fixed in version 2026.2.21