N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8fmp-37rc-p5g7

GHSA-8fmp-37rc-p5g7: OpenClaw's config env vars allowed startup env injection into service runtime

Summary

OpenClaw allowed dangerous process-control environment variables from env.vars (for example NODE_OPTIONS, LD_*, DYLD_*) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.

Details

collectConfigEnvVars() accepted unfiltered keys from config and those values were merged into the daemon install environment in buildGatewayInstallPlan(). Before the fix, startup-control variables were not blocked in this path.

Affected Packages / Versions

Package: openclaw (npm)
Latest published affected version: 2026.2.19-2 (published February 19, 2026)
Affected range (structured): <=2026.2.19-2 || =2026.2.19
Patched version (pre-set for next release): >= 2026.2.21

Fix Commit(s)

2cdbadee1f8fcaa93302d7debbfc529e19868ea4

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21). Once that npm release is published, this advisory is ready to publish without further content edits.

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8fmp-37rc-p5g7

GHSA-8fmp-37rc-p5g7:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.21	2026.2.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-8fmp-37rc-p5g7, stems from OpenClaw's failure to properly sanitize environment variables across multiple parts of its codebase. The core issue was that several functions responsible for handling environment variables used incomplete, decentralized blocklists, allowing malicious actors to inject dangerous variables (e.g., BASH_ENV, LD_PRELOAD, DYLD_INSERT_LIBRARIES). These variables could be used to control the application's runtime behavior and achieve arbitrary code execution at startup.

The patch addresses this by introducing a centralized and more comprehensive sanitization mechanism in src/infra/host-env-security.ts for TypeScript code and apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift for Swift code. The vulnerable functions, which previously had their own flawed sanitization logic, were refactored to use these new, secure utilities.

The analysis identified the key functions that were vulnerable prior to the patch. These include collectConfigEnvVars, which ingested unsanitized variables from configuration, and several sanitizeEnv or sanitizedEnv methods across the Node.js and macOS components that failed to block all dangerous variables.

Vulnerable functions

collectConfigEnvVars

src/config/env-vars.ts

The function `collectConfigEnvVars` collected environment variables from the configuration without filtering out dangerous variables like `BASH_ENV`, `LD_*`, etc. This allowed startup-time code execution. The patch adds a check using `isDangerousHostEnvVarName` to prevent this.

validateHostEnv

src/agents/bash-tools.exec-runtime.ts

The function `validateHostEnv` used an incomplete, local blocklist (`DANGEROUS_HOST_ENV_VARS`, `DANGEROUS_HOST_ENV_PREFIXES`) to check for malicious environment variables. This could be bypassed. The patch replaces this with a call to the centralized and more comprehensive `isDangerousHostEnvVarName` function.

sanitizeSkillEnvOverrides

src/agents/skills/env-overrides.ts

The function `sanitizeSkillEnvOverrides` used a hardcoded and incomplete list of regular expressions (`HARD_BLOCKED_SKILL_ENV_PATTERNS`) to block dangerous environment variables for skills. This was insufficient. The patch introduces `isAlwaysBlockedSkillEnvKey` which leverages the new centralized `isDangerousHostEnvVarName` function for a more robust check.

sanitizeEnv

src/node-host/invoke.ts

The original `sanitizeEnv` function in `invoke.ts` implemented its own environment variable sanitization logic with an incomplete set of blocklists (`blockedEnvKeys`, `blockedEnvPrefixes`). This vulnerable implementation was removed and replaced with a call to the new centralized `sanitizeHostExecEnv` function.

ExecHostExecutor.sanitizedEnv

apps/macos/Sources/OpenClaw/ExecApprovalsSocket.swift

The `sanitizedEnv` function within `ExecHostExecutor` used a local, incomplete blocklist (`blockedEnvKeys`, `blockedEnvPrefixes`) to sanitize environment variables on macOS. This could allow dangerous variables to be set. The patch replaces the vulnerable implementation with a call to the centralized `HostEnvSanitizer.sanitize` function.

MacNodeRuntime.sanitizedEnv

apps/macos/Sources/OpenClaw/NodeMode/MacNodeRuntime.swift

Similar to `ExecHostExecutor`, the `sanitizedEnv` function in `MacNodeRuntime` had its own vulnerable implementation for sanitizing environment variables on macOS, using an incomplete blocklist. The patch replaces this with a call to the secure `HostEnvSanitizer.sanitize` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.