Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the shell-env functionality of OpenClaw, specifically in how it determines a trusted shell for execution. The core of the vulnerability lies in the isTrustedShellPath function within src/infra/shell-env.ts. Before the patch, this function had a dangerous fallback mechanism. If a shell specified in the $SHELL environment variable was not found in /etc/shells, the function would check if the shell's path began with a hardcoded 'trusted' prefix (like /bin/, /usr/local/bin/, or /opt/homebrew/bin/). If the prefix matched and the file was executable, it was deemed trusted.
An attacker could exploit this by placing a malicious executable in a writable directory that matches one of these trusted prefixes (a common scenario with Homebrew in /opt/homebrew/bin). By then setting the $SHELL environment variable to point to their malicious file, they could trick the application into running it.
The function loadShellEnvFallback is the entry point that triggers this vulnerable logic. It calls resolveShell, which in turn uses isTrustedShellPath to validate the shell. After validation, loadShellEnvFallback proceeds to execute the selected shell to probe for environment variables. This execution of an attacker-controlled binary leads to arbitrary code execution.
The patch remediates this vulnerability by removing the trusted prefix fallback entirely from the isTrustedShellPath function. The patched version only considers a shell trusted if it is explicitly listed in /etc/shells, otherwise it safely defaults to /bin/sh. The identified vulnerable functions, isTrustedShellPath and loadShellEnvFallback, would appear in a runtime profile during an exploit scenario, with isTrustedShellPath performing the flawed validation and loadShellEnvFallback performing the subsequent malicious execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openclaw | npm | >= 2026.2.22, < 2026.2.23 | 2026.2.23 |
