Executive brief
OpenClaw is an AI automation platform that executes tasks across operating systems. A vulnerability in its shell environment initialization allows attackers who can control configuration or environment variables to inject arbitrary commands through shell startup paths (HOME, ZDOTDIR, SHELL). This could lead to unauthorized code execution in the OpenClaw host process context when affected versions process untrusted configuration.
Technical details
The vulnerability exists in OpenClaw's shell-env fallback implementation (src/infra/shell-env.ts, src/config/io.ts, src/config/env-vars.ts) where configuration environment values are applied before shell fallback execution without proper sanitization. The code executes `${SHELL} -l -c "env -0"` with inherited runtime environment, and trusts the SHELL variable along with startup-path selectors (HOME, ZDOTDIR) that influence shell initialization scripts. An attacker with the ability to influence config-supplied environment variables or env/config input can craft malicious values for these variables to trigger arbitrary command execution during shell startup processing. The fix (commit 9363c320d8ffe29290906752fab92621da02c3f7, released in version 2026.2.22) blocks SHELL, HOME, and ZDOTDIR during config env ingestion, sanitizes shell fallback execution environment by pinning HOME to the real user home, and drops ZDOTDIR and other dangerous startup variables. This vulnerability requires local access and crosses trusted-operator boundaries under OpenClaw's threat model.
Affected products
- OpenClaw openclaw >=2026.1.5 and <=2026.2.21-2
Timeline
- 2026-03-03: disclosed
- 2026-02-22: patched: Fix committed to main branch; planned release 2026.2.22