GHSA-w9cg-v44m-4qv8 OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
Attackers with local or privileged influence over environment variables can inject commands into spawned shells, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-w9cg-v44m-4qv8?
GHSA-w9cg-v44m-4qv8 is a command injection vulnerability in openclaw, published on 3 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Summary
BASH_ENV / ENV startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.19-2 - Fixed on
main:2cdbadee1f8fcaa93302d7debbfc529e19868ea4 - Planned patched release version:
2026.2.21
Details
The fix hardens environment handling across all relevant execution paths:
- Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization.
- Sanitizes inherited ambient environment even when no per-request overrides are provided.
- Blocks dangerous config-driven env injection before values enter process environment.
- Uses the same sanitizer in macOS host execution paths.
- Aligns skill env override sanitization with the shared dangerous-env policy.
Impact
Medium. Exploitation requires local/privileged influence over configuration or environment inputs; there is no standalone remote unauthenticated trigger from this issue alone.
Fix Commit(s)
2cdbadee1f8fcaa93302d7debbfc529e19868ea4
Release Process Note
patched_versions is pre-set to the planned next release (2026.2.21). Once npm [email protected] is published, the advisory can be published without further field edits.
OpenClaw thanks @tdjackey for reporting.
Which versions are affected by GHSA-w9cg-v44m-4qv8?
2 open source packages ship an affected version, including openclaw.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.2.21 |
openclaw npm | All versions | 2026.2.21 |
How do I fix GHSA-w9cg-v44m-4qv8?
Upgrade openclaw to 2026.2.21 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-w9cg-v44m-4qv8 being exploited?
There is no known exploitation of GHSA-w9cg-v44m-4qv8 in the wild and no public exploit code.