4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-f8mp-vj46-cq8v

GHSA-f8mp-vj46-cq8v: OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment

The shell environment fallback path could invoke an attacker-controlled shell when SHELL was inherited from an untrusted host environment. In affected builds, shell-env loading used $SHELL -l -c 'env -0' without validating that SHELL points to a trusted executable.

In threat-model terms, this requires local environment compromise or untrusted startup environment injection first; it is not a remote pre-auth path. The hardening patch validates SHELL as an absolute normalized executable, prefers /etc/shells, applies trusted-prefix fallback checks, and falls back safely to /bin/sh when validation fails. The dangerous env-var policy now also blocks SHELL overrides.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.21-2
Latest published vulnerable version: 2026.2.21-2
Patched versions (planned next release): >= 2026.2.22

Fix Commit(s)

25e89cc86338ef475d26be043aa541dfdb95e52a

Release Process Note

The advisory pre-sets patched_versions to the planned next release (2026.2.22). After that npm release is published, maintainers can publish this advisory without further version-field edits.

OpenClaw thanks @athuljayaram for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-f8mp-vj46-cq8v

GHSA-f8mp-vj46-cq8v:

4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.22	2026.2.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the openclaw package's shell environment loading mechanism. The root cause is the lack of validation of the SHELL environment variable. The function resolveShell in src/infra/shell-env.ts would read the SHELL variable from the process environment and return it without checking if it pointed to a legitimate, trusted shell executable.

The value returned by resolveShell is then used by the execLoginShellEnvZero function, which executes the provided shell path to load environment variables. This creates a command injection vulnerability. If an attacker can control the SHELL environment variable in the context where the openclaw application is started, they can point it to a malicious binary, which will then be executed by execLoginShellEnvZero.

The entry point for this vulnerable logic is the loadShellEnvFallback function, which is exported and used by other parts of the application. The fix involves introducing a new function, isTrustedShellPath, which validates the shell path against a list of trusted prefixes and checks if it's listed in /etc/shells. The resolveShell function was updated to use this validation, falling back to a safe default (/bin/sh) if the validation fails. Additional defense-in-depth measures were also added to block SHELL from being overridden through the application's configuration.

Vulnerable functions

resolveShell

src/infra/shell-env.ts

This function is responsible for determining which shell executable to use. In the vulnerable version, it directly returned the path from the `SHELL` environment variable without any validation. This allowed an attacker to specify a malicious executable to be run.

execLoginShellEnvZero

src/infra/shell-env.ts

This function receives the shell path from `resolveShell` and executes it to get environment variables. It is the function that directly executes the untrusted shell path, leading to code execution.

loadShellEnvFallback

src/infra/shell-env.ts

This is the main exported function that triggers the vulnerable behavior. It orchestrates the process of loading the shell environment by calling `execLoginShellEnvZero`, which in turn uses the insecure `resolveShell` function. An attacker would exploit the vulnerability by causing the application to call this function in a compromised environment.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.