6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j425-whc4-4jgc

GHSA-j425-whc4-4jgc: OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

Summary

system.run env override sanitization allowed dangerous override-only helper-command pivots to reach subprocesses. A caller who could invoke system.run with env overrides could bypass allowlist/approval intent by steering an allowlisted tool through helper-command or config-loading environment variables such as GIT_SSH_COMMAND, editor/pager hooks, and GIT_CONFIG_* / NPM_CONFIG_*.

Affected Packages / Versions

Package: openclaw (npm)
Latest published vulnerable version: 2026.3.2
Affected range: <= 2026.3.2
Patched in: 2026.3.7

Details

Before the fix, src/infra/host-env-security.ts blocked only a narrow set of override-only environment variables. Dangerous request-scoped overrides such as GIT_SSH_COMMAND and prefix families such as GIT_CONFIG_* and NPM_CONFIG_* could still survive sanitizeSystemRunEnvOverrides(...) / sanitizeHostExecEnv(...) and reach the spawned process.

That mattered for system.run allowlist and approval flows because approval evaluation was tied to the reviewed binary/argv, while the launched process could still inherit attacker-controlled env overrides that changed helper-command execution or config resolution. For allowlisted tools such as git, this allowed behavior outside the reviewed command semantics.

The fix extends the shared TypeScript and macOS policy to block dangerous override-only exact keys and prefixes while preserving trusted inherited base-environment behavior.

Impact

This is a real protection-bypass issue, but exploitation requires an already tool-enabled caller who can invoke system.run and supply env overrides. In affected deployments, that caller could bypass allowlist/approval intent and trigger helper-command execution or config-loading behavior that is not represented by the approved command line. Maintainer severity is set to medium because the bug still requires that existing execution capability; the vulnerability is the mismatch between reviewed command semantics and the actual spawned-process behavior.

Miggo Vulnerability Database

→

GHSA-j425-whc4-4jgc

GHSA-j425-whc4-4jgc:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-j425-whc4-4jgc, is a security bypass in OpenClaw's system.run functionality. The root cause was an incomplete environment variable sanitization process. The core logic flaw resided in the isDangerousHostEnvOverrideVarName function (and its Swift equivalent in HostEnvSanitizer), which was responsible for identifying and blocking potentially malicious environment variables supplied by a user.

The original implementation only checked for an exact match against a denylist of variable names. This left the system open to attacks using variables that were not on the exact-match list but are known to be dangerous, such as GIT_SSH_COMMAND, or variables that work as a family using a common prefix, like GIT_CONFIG_* and NPM_CONFIG_*.

An attacker with the ability to invoke system.run and provide environment variable overrides could exploit this flaw. By setting a variable like GIT_SSH_COMMAND, they could force an allowlisted tool (e.g., git) to execute an arbitrary command, effectively bypassing the security controls and command-line review process.

The patch addresses this by extending the sanitization logic. It adds a new denylist for variable prefixes (blockedOverridePrefixes) and expands the list of exact-match keys. The isDangerousHostEnvOverrideVarName function was updated to check both the exact-match list and the new prefix list, ensuring a much broader range of dangerous variables are caught and removed. The functions sanitizeSystemRunEnvOverrides and sanitizeHostExecEnv, which are called to prepare the environment for subprocesses, now correctly filter out these malicious variables, closing the bypass vulnerability.

Vulnerable functions

sanitizeSystemRunEnvOverrides

src/infra/host-env-security.ts

This function sanitizes environment variable overrides. Before the patch, it relied on the `isDangerousHostEnvOverrideVarName` function, which performed an incomplete check. It failed to block dangerous environment variables based on prefixes (e.g., `GIT_CONFIG_`, `NPM_CONFIG_`) or other specific keys (`GIT_SSH_COMMAND`), allowing an attacker to pass malicious environment variables to subprocesses and bypass security controls.

sanitizeHostExecEnv

src/infra/host-env-security.ts

This function prepares a sanitized environment for executing host commands. It was vulnerable because it used the flawed `isDangerousHostEnvOverrideVarName` function for filtering environment variable overrides. This allowed malicious variables to be passed to the execution environment, leading to a bypass of intended security policies.

isDangerousHostEnvOverrideVarName

src/infra/host-env-security.ts

This function is the root cause of the vulnerability. Its original implementation only checked for exact matches against a list of dangerous environment variable keys. It did not check for dangerous prefixes (like `GIT_CONFIG_`) or a number of other command-injection vectors (like `GIT_SSH_COMMAND`), making the sanitization process that relied on it incomplete and bypassable.

HostEnvSanitizer.sanitize

apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift

This is the Swift equivalent of the TypeScript sanitization functions for the macOS application. It was vulnerable in the same way, failing to filter environment variables based on dangerous prefixes. The patch replaces a direct check against `blockedOverrideKeys` with a call to the new `isBlockedOverride` helper function, which includes the necessary prefix checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.