Executive brief
OpenClaw is a JavaScript library that executes shell commands with an allowlist mechanism to restrict dangerous operations. The system.run function fails to sanitize shell startup environment variables (HOME and ZDOTDIR), allowing attackers to inject malicious startup files like .bash_profile or .zshenv that execute before the allowlist-protected command runs, achieving arbitrary code execution.
Technical details
OpenClaw versions prior to 2026.2.22 have a command injection vulnerability (CWE-78) in the system.run function. The vulnerability stems from incomplete environment variable sanitization: while the code blocks many dangerous environment keys, it fails to filter HOME and ZDOTDIR—shell startup override variables that can redirect execution to attacker-controlled files. An authenticated attacker can set HOME or ZDOTDIR to a path under their control, place a malicious startup file (.bash_profile for bash or .zshenv for zsh), and have it executed before the allowlist-evaluated command body runs. The attack requires network access and authentication but bypasses the allowlist intent entirely. The fix is available in version 2026.2.22 and later.
Affected products
- OpenClaw openclaw < 2026.2.22
Timeline
- 2026-02-23: disclosed
- 2026-02-22: patched: Version 2026.2.22 available
- 2026-03-21: other: Duplicate advisory GHSA-rj39-33v7-9xrq published
- 2026-03-24: other: Duplicate advisory withdrawn