N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-mj59-h3q9-ghfh

GHSA-mj59-h3q9-ghfh: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

Workspace MCP stdio configuration could pass dangerous process-startup environment variables such as NODE_OPTIONS, LD_PRELOAD, or BASH_ENV to the spawned MCP server process. In a malicious workspace, this could make the MCP child load attacker-controlled code when the operator starts a session that uses that MCP server.

The impact is limited to local/workspace trust boundaries and requires the operator to run OpenClaw in a workspace containing the malicious MCP configuration. Severity is therefore medium, not high/critical.

Fix

OpenClaw now filters MCP stdio environment entries through the host environment safety denylist before spawning stdio MCP servers.

Fix commits:

62fa5071896e95edc7f67d1cebc70a2859e283af
85d86ebc4bf3d2226d39d132a484f4f7a299fa1b

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-mj59-h3q9-ghfh

GHSA-mj59-h3q9-ghfh:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the fact that OpenClaw was not sanitizing environment variables passed from a workspace configuration to a spawned MCP server process. Specifically, the resolveStdioMcpServerLaunchConfig function in src/agents/mcp-stdio.ts was using the toMcpStringRecord function to process these variables. The toMcpStringRecord function, prior to the patch, did not filter out any potentially dangerous environment variables. This would allow a malicious workspace to set variables like NODE_OPTIONS, LD_PRELOAD, or BASH_ENV, leading to arbitrary code execution when a user initiates a session. The patch addresses this by introducing a new function, toMcpEnvRecord, which filters environment variables against a denylist of dangerous variable names. The resolveStdioMcpServerLaunchConfig function was then updated to use this new, safer function.

Vulnerable functions

resolveStdioMcpServerLaunchConfig

src/agents/mcp-stdio.ts

This function was vulnerable because it used the `toMcpStringRecord` function to process environment variables from a workspace configuration. `toMcpStringRecord` did not filter out dangerous environment variables, such as `NODE_OPTIONS` or `LD_PRELOAD`, which could be used by a malicious workspace to execute arbitrary code when a user starts a session.

toMcpStringRecord

src/agents/mcp-config-shared.ts

This function was part of the vulnerability because it did not perform any filtering of the environment variables. It would blindly convert all provided environment variables from the workspace configuration into a string record, which was then used to launch the MCP server process. This allowed dangerous variables to be passed through.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.