EUVD-2026-28180
GHSA-vfp4-8x56-j7c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this by manipulating these environment variables to influence downstream execution behavior or network connectivity.
AnalysisAI
Environment variable injection in OpenClaw before 2026.4.10 allows authenticated remote attackers to hijack interpreter execution behavior through insufficient filtering of high-risk startup variables (VIMINIT, EXINIT, LUA_INIT, HOSTALIASES). The vulnerability enables code execution by manipulating how downstream interpreters (Vim, ex, Lua) initialize and resolve hostnames. Patched in version 2026.4.10 following coordinated disclosure by Tencent zhuque Lab. No public exploit identified at time of analysis, though CVSS 8.7 reflects network-exploitable attack surface with low complexity requiring only low-privilege authentication.
Technical ContextAI
The vulnerability exists in OpenClaw's HostEnvSecurityPolicy module (specifically HostEnvSanitizer.swift), which sanitizes environment variables passed to exec() calls in operator-controlled environments. The original denylist failed to block interpreter startup variables that control initialization behavior: VIMINIT and EXINIT (Vim/ex editor commands), LUA_INIT variants (Lua pre-execution code), and HOSTALIASES (DNS hostname aliasing file path). These variables are classified under CWE-184 (Incomplete List of Disallowed Inputs), a filter bypass weakness. When OpenClaw spawns child processes inheriting operator-supplied environment variables, attackers can inject malicious values for these variables to achieve arbitrary code execution in the context of those interpreters or redirect network connections through hostile hostname mappings. The fix (commit 2d126fc) expands the denylist from a small set to over 200 blocked keys including AWS credentials, Git control paths, compiler flags, and interpreter startup vectors. The npm package ecosystem is affected, with the macOS Swift codebase containing the vulnerable logic.
RemediationAI
Upgrade OpenClaw to version 2026.4.10 or later. The fix is included in npm package openclaw@2026.4.14 (latest at time of advisory). The patch (commit 2d126fc62343a7b6895351f96e4e1474bc358140, PR #63277) expands HostEnvSecurityPolicy.blockedInheritedKeys to include VIMINIT, EXINIT, LUA_INIT variants, HOSTALIASES, and over 200 additional high-risk variables covering AWS credentials, compiler flags, and interpreter control paths. Review GitHub advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-vfp4-8x56-j7c5 and commit diff at https://github.com/openclaw/openclaw/commit/2d126fc62343a7b6895351f96e4e1474bc358140 for full technical details. If upgrade is delayed, implement compensating controls: restrict operator access to OpenClaw execution environments, audit all environment variable sources passed to exec contexts, and deploy runtime monitoring for suspicious interpreter startup variable usage (detect VIMINIT, EXINIT, LUA_INIT in process environments). Note that compensating controls are complex to implement correctly given the breadth of blocked variables in the patch (200+ entries), making upgrade the strongly preferred remediation path.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today