Executive brief
OpenClaw is a tool for executing system commands with security controls like allowlists and approval workflows. The vulnerability allows authenticated callers who already have permission to invoke certain tools to bypass those controls by injecting environment variables (like GIT_SSH_COMMAND) that alter the actual behavior of spawned processes without the approval process detecting the change. This is a protection mechanism failure that could allow unintended command execution.
Technical details
The vulnerability is a protection mechanism bypass in OpenClaw's `system.run` functionality. The `sanitizeSystemRunEnvOverrides()` and `sanitizeHostExecEnv()` functions in `src/infra/host-env-security.ts` failed to block dangerous environment variable overrides such as GIT_SSH_COMMAND, GIT_CONFIG_*, and NPM_CONFIG_* prefixes. Although these are "override-only" variables, they can redirect tool helper-command execution or config resolution. An attacker with existing `system.run` invocation capability can supply malicious environment overrides that change the effective behavior of allowlisted tools (e.g., git) beyond what the approval review covered. The fix (commit e27bbe4) extends the environment variable blocklist to catch these dangerous exact keys and prefix families. No special privileges or user interaction beyond supplying env overrides is required.
Affected products
- OpenClaw openclaw <= 2026.3.2
Timeline
- 2026-03-09: disclosed: Advisory published
- 2026-03-08: patched: Fix released in version 2026.3.7