EUVD-2026-12730
GHSA-p4wh-cr8m-gm6c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw version 2026.2.22 prior to 2026.2.23 contain an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context.
AnalysisAI
OpenClaw versions prior to 2026.2.23 contain an arbitrary code execution vulnerability in shell-env that allows local attackers with low privileges to execute attacker-controlled binaries by manipulating the $SHELL environment variable through trusted-prefix fallback logic. An attacker who can write to directories like /opt/homebrew/bin can trick OpenClaw into executing malicious binaries in its process context, potentially escalating privileges or compromising system integrity. A patch is available from the vendor, and this vulnerability has been documented by VulnCheck and tracked under EUVD-2026-12730.
Technical ContextAI
The vulnerability resides in OpenClaw's shell-env component, which handles shell environment variable resolution (CWE-829: Improper Control of a Resource Through its Lifetime). The root cause is insecure fallback logic when resolving the $SHELL variable: if the primary shell path is unavailable, OpenClaw falls back to searching trusted-prefix directories such as /opt/homebrew/bin without proper validation. An attacker with write access to these directories can place a malicious binary that gets executed when OpenClaw attempts to spawn a shell. This is a classic example of untrusted search path manipulation combined with insufficient path validation. The affected product is identified via CPE as cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, and the vulnerability specifically affects OpenClaw 2026.2.22 and earlier releases.
RemediationAI
Immediately upgrade OpenClaw to version 2026.2.23 or later, which includes the fix documented in commit ff10fe8b91670044a6bb0cd85deb736a0ec8fb55. Refer to the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-p4wh-cr8m-gm6c for detailed upgrade instructions. As an interim mitigation prior to patching, restrict write access to trusted-prefix directories such as /opt/homebrew/bin, /usr/local/bin, and other package manager installation paths to the root user only. Additionally, audit the $SHELL environment variable configuration across systems and remove or validate any custom shell paths. Monitor process execution logs for unexpected shell spawning or binary execution from unusual paths to detect exploitation attempts.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Share
External POC / Exploit Code
Leaving vuln.today