GHSA-39PP-XP36-Q6MG: GHSA-39pp-xp36-q6mg: Remote Code Execution via Environment Variable Injection in OpenClaw

#security #cve #cybersecurity #ghsa

GHSA-39pp-xp36-q6mg: Remote Code Execution via Environment Variable Injection in OpenClaw

Vulnerability ID: GHSA-39PP-XP36-Q6MG
CVSS Score: 9.8
Published: 2026-03-26

OpenClaw versions prior to 2026.3.22 are vulnerable to Remote Code Execution (RCE) due to inconsistent sanitization of environment variable overrides between the Gateway and Node components. This architectural flaw allows attackers to inject shell-sensitive variables, resulting in arbitrary command execution on the host system.

TL;DR

Inconsistent environment variable sanitization in OpenClaw's skill execution pipeline permits malicious overrides of variables like HOME and ZDOTDIR, enabling unauthenticated Remote Code Execution on the host.

Technical Details

Vulnerability Class: Environment Variable Injection
CWE ID: CWE-78
Attack Vector: Network
Impact: Remote Code Execution
Exploit Status: Unexploited / Undisclosed
Component: Skill Env Handler

Affected Systems

OpenClaw Gateway
OpenClaw Node
OpenClaw: < 2026.3.22 (Fixed in: 2026.3.22)

Mitigation Strategies

Implement strict allowlists for environment variable overrides.
Enforce a unified sanitization pipeline across all system components.
Adopt a fail-closed error handling model for validation failures.

Remediation Steps:

Upgrade OpenClaw to version 2026.3.22 or later.
Review historical skill configurations for unauthorized or suspicious environment variable overrides.
Monitor application logs for task execution failures related to blocked environment variables.