Every CVESearch/Get API key

GHSA-w9cg-v44m-4qv8

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

7.3 HighFix available

GHSA-w9cg-v44m-4qv8 is a high vulnerability (CVSS 7.3) in openclaw, published March 3, 2026. No source lists public exploit code. Fixed in openclaw 2026.2.21.

What does this mean?
Severity
7.3 HighCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2026.2.21openclaw

Description

Summary

BASH_ENV / ENV startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.19-2
  • Fixed on main: 2cdbadee1f8fcaa93302d7debbfc529e19868ea4
  • Planned patched release version: 2026.2.21

Details

The fix hardens environment handling across all relevant execution paths:

  • Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization.
  • Sanitizes inherited ambient environment even when no per-request overrides are provided.
  • Blocks dangerous config-driven env injection before values enter process environment.
  • Uses the same sanitizer in macOS host execution paths.
  • Aligns skill env override sanitization with the shared dangerous-env policy.

Impact

Medium. Exploitation requires local/privileged influence over configuration or environment inputs; there is no standalone remote unauthenticated trigger from this issue alone.

Fix Commit(s)

  • 2cdbadee1f8fcaa93302d7debbfc529e19868ea4

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21). Once npm openclaw@2026.2.21 is published, the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
before 2026.2.21
2026.2.21

What each source reports

GitHub Advisories Score used7.3

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

Summary

BASH_ENV / ENV startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.19-2
  • Fixed on main: 2cdbadee1f8fcaa93302d7debbfc529e19868ea4
  • Planned patched release version: 2026.2.21

Details

The fix hardens environment handling across all relevant execution paths:

  • Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization.
  • Sanitizes inherited ambient environment even when no per-request overrides are provided.
  • Blocks dangerous config-driven env injection before values enter process environment.
  • Uses the same sanitizer in macOS host execution paths.
  • Aligns skill env override sanitization with the shared dangerous-env policy.

Impact

Medium. Exploitation requires local/privileged influence over configuration or environment inputs; there is no standalone remote unauthenticated trigger from this issue alone.

Fix Commit(s)

  • 2cdbadee1f8fcaa93302d7debbfc529e19868ea4

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21). Once npm openclaw@2026.2.21 is published, the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-w9cg-v44m-4qv8
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-15, CWE-78
Updated
2026-11-02
OSV7.3

OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

Summary

BASH_ENV / ENV startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.19-2
  • Fixed on main: 2cdbadee1f8fcaa93302d7debbfc529e19868ea4
  • Planned patched release version: 2026.2.21

Details

The fix hardens environment handling across all relevant execution paths:

  • Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization.
  • Sanitizes inherited ambient environment even when no per-request overrides are provided.
  • Blocks dangerous config-driven env injection before values enter process environment.
  • Uses the same sanitizer in macOS host execution paths.
  • Aligns skill env override sanitization with the shared dangerous-env policy.

Impact

Medium. Exploitation requires local/privileged influence over configuration or environment inputs; there is no standalone remote unauthenticated trigger from this issue alone.

Fix Commit(s)

  • 2cdbadee1f8fcaa93302d7debbfc529e19868ea4

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21). Once npm openclaw@2026.2.21 is published, the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Record
GHSA-w9cg-v44m-4qv8
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-15, CWE-78
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open