Openclaw EUVD-2026-13958

Requires authenticated access to OpenClaw versions prior to 2026.2.22. Attacker must have low-privilege user credentials and ability to control HOME or ZDOTDIR environment variables before invoking system.run function. Victim interaction not required. Exploits unsanitized shell startup files (.bash_profile, .zshenv) to bypass command allowlist.

This vulnerability presents moderate to high real-world risk with a CVSS score of 7.5. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with high attack complexity requiring low privileges and no user interaction, enabling complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) suggests exploitation requires specific conditions such as access to vulnerable system.run invocations with attacker-controlled inputs, which somewhat limits the attack surface. The vulnerability enables complete arbitrary code execution before allowlist validation, making it particularly dangerous in environments where OpenClaw is used to provide restricted command execution capabilities. The availability of a vendor patch and the existence of detailed advisories from VulnCheck and GitHub Security Advisories indicate this is a confirmed, actively tracked vulnerability that should be prioritized for patching, especially in internet-facing deployments or multi-tenant environments where low-privilege users could escalate privileges.

An authenticated attacker with low-level privileges gains network access to an OpenClaw instance and identifies functionality that invokes the vulnerable system.run function. The attacker crafts a request that sets the HOME environment variable to point to an attacker-controlled directory (potentially a web-accessible or shared filesystem location) containing a malicious .bash_profile file with reverse shell code. When system.run spawns a shell process, the shell reads and executes the attacker's startup file before any allowlisted command runs, granting the attacker arbitrary code execution with the privileges of the OpenClaw process, effectively bypassing all command restrictions.