EUVD-2026-26129
GHSA-7437-7hg8-frrw
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity; low privilege suffices; scope changes as injected env vars hijack child build tool processes outside OpenClaw's own security context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary code execution.
AnalysisAI
Remote code execution in OpenClaw (npm) before version 2026.4.8 is achievable by injecting malicious build tool environment variables - specifically HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS - which were absent from the application's exec environment denylist. Because OpenClaw is a user-controlled local assistant, an attacker with the ability to set environment variables on the host can influence exec commands invoked by the tool and achieve arbitrary code execution. No public exploit code has been identified at time of analysis, and SSVC signals indicate no current exploitation activity, but the integrity impact (VI:H) is significant when exploitation conditions are met.
Technical ContextAI
OpenClaw is an npm-distributed local AI coding assistant (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). The vulnerability class is CWE-184 (Incomplete List of Disallowed Inputs): the application maintains a denylist of environment variables filtered before passing the environment to child processes or exec calls. Four security-sensitive build tool variables - HGRCPATH (Mercurial config path override), CARGO_BUILD_RUSTC_WRAPPER and RUSTC_WRAPPER (Rust/Cargo compiler wrapper redirects), and MAKEFLAGS (GNU Make flag injection) - were absent from this denylist. These variables are natively respected by their respective build tools and can redirect compilation steps to execute attacker-controlled binaries or load attacker-controlled configurations, injecting code into the host build execution context. The vulnerability class is related to GHSA-cm8v-2vh9-cxf3, indicating a known and recurring pattern of environment variable injection against developer tooling.
RemediationAI
Upgrade the OpenClaw npm package to version 2026.4.8 or later, which adds HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS to the exec environment denylist. The vendor-confirmed fix is at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5), re-verified against main before publication with targeted regression tests per the GHSA advisory. If immediate upgrade is not feasible, unset these four environment variables in the shell session before invoking OpenClaw (e.g., unset HGRCPATH CARGO_BUILD_RUSTC_WRAPPER RUSTC_WRAPPER MAKEFLAGS) - note this will break legitimate Mercurial, Cargo, and Make workflows for the duration of the session. A stronger compensating control is launching OpenClaw with a clean environment (env -i plus explicit re-export of needed variables), but this requires careful enumeration of dependencies and may disrupt tool integrations.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today