Executive brief
OpenClaw is a popular security tool used to control and restrict execution environments. This vulnerability allows attackers who can set environment variables to bypass security restrictions by manipulating startup variables for interpreters like Vim, Lua, and shell commands. An attacker could influence how programs behave or redirect network traffic without proper authorization.
Technical details
The vulnerability is an insufficient denylist issue (CWE-184) in OpenClaw's exec environment security policy. The policy failed to block high-risk interpreter startup environment variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. An authenticated operator or local process with environment variable manipulation capability can exploit this by setting these variables to influence downstream execution behavior or network connectivity. The fix, released in version 2026.4.10, expands the denylist to comprehensively cover these and related high-risk environment variables.
Affected products
- OpenClaw OpenClaw < 2026.4.10
Timeline
- 2026-04-16: disclosed
- 2026-04-16: patched: Fixed in version 2026.4.10
- 2026-05-06: advisory
- 2026-05-11: other: Advisory GHSA-xrgf-r9gr-jjjf withdrawn as duplicate of GHSA-vfp4-8x56-j7c5