Executive brief
OpenClaw is an AI-powered local assistant that executes commands on your system. A flaw in its host command execution could allow inherited environment variables to influence how shells, interpreters, or build tools behave, potentially allowing an attacker with local access to manipulate command execution and compromise system operations.
Technical details
The vulnerability is an improper neutralization of special elements in OS command construction (CWE-78), where OpenClaw's host-exec functionality fails to sanitize environment variables that influence interpreter and shell behavior. The vulnerability requires local access to the system running OpenClaw and is scoped within the OpenClaw trust model (local assistant, not multi-tenant). An attacker can inherit or inject environment variables that modify how executed commands behave, potentially leading to arbitrary command execution or privilege escalation. The issue was patched in version 2026.4.8 (commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5), with regression tests confirming the fix.
Affected products
- OpenClaw OpenClaw <= 2026.3.28
Timeline
- 2026-04-09: disclosed
- 2026-04-08: patched: Version 2026.4.8 released