N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j9pv-rrcj-6pfx

GHSA-j9pv-rrcj-6pfx: OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

Summary

SSH-based sandbox backends pass unsanitized process.env to child processes

Current Maintainer Triage

Status: narrow
Normalized severity: low
Assessment: Shipped SSH sandbox paths leaked unsanitized env into local SSH child processes, but remote leakage needs non-default SSH env forwarding, so lower to low.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

cfe14459531e002a1c61c27d97ec7dc8aecddc1f — 2026-03-30T20:05:57+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j9pv-rrcj-6pfx

GHSA-j9pv-rrcj-6pfx:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the fact that several functions responsible for creating and managing SSH-based sandboxes in OpenClaw were passing the entire, unsanitized process.env of the main application to child processes. These child processes, which execute SSH commands, would then inherit all environment variables, including potentially sensitive ones like API keys or other credentials. An attacker with the ability to inspect the environment of the sandboxed processes could exfiltrate this sensitive information. The patch addresses this by introducing a sanitizeEnvVars function that filters the environment variables, removing any that match a blocklist of sensitive patterns before they are passed to any child SSH processes. The analysis of the fix commit cfe14459531e002a1c61c27d97ec7dc8aecddc1f clearly shows the replacement of process.env with a sanitized version in functions like createOpenShellSandboxBackend, runSshSandboxCommand, and uploadDirectoryToSshTarget, confirming these as the locations of the vulnerability.

Vulnerable functions

createOpenShellSandboxBackend

extensions/openshell/src/backend.ts

This function, when preparing to execute a command in a sandbox, was using the unsanitized `process.env`. This could lead to sensitive environment variables from the host being leaked to the sandboxed process. The patch replaces the direct use of `process.env` with a call to `buildOpenShellSshExecEnv()`, which sanitizes the environment variables.

OpenShellSandboxBackendImpl.buildExecSpec

extensions/openshell/src/backend.ts

This method created an execution specification for a sandboxed command and included the unsanitized `process.env`. This would cause the command to be executed with potentially sensitive environment variables from the host. The fix replaces `process.env` with a call to the sanitizing function `buildOpenShellSshExecEnv()`.

SshSandboxBackendImpl.buildExecSpec

src/agents/sandbox/ssh-backend.ts

This method built an execution specification for an SSH-based sandbox, passing the unsanitized `process.env` to the child process. This could leak sensitive environment variables to the SSH session. The patch applies `sanitizeEnvVars` to `process.env` before passing it to the execution environment.

runSshSandboxCommand

src/agents/sandbox/ssh.ts

This function spawned a child process to run an SSH command, and it passed the unsanitized `process.env` to this new process. This could expose sensitive environment variables to the SSH command and potentially the remote machine. The fix is to sanitize `process.env` using `sanitizeEnvVars` before spawning the process.

uploadDirectoryToSshTarget

src/agents/sandbox/ssh.ts

This function, used for uploading files via SSH, spawned an `ssh` child process with the unsanitized `process.env`. This created a risk of leaking sensitive environment variables from the host to the SSH process. The patch ensures the environment is sanitized with `sanitizeEnvVars` before being used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.