N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-p4wh-cr8m-gm6c

GHSA-p4wh-cr8m-gm6c: OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

Summary

shell-env fallback trusted prefix-based executable paths for $SHELL, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios.

Details

In affected versions, shell selection accepted either:

a shell listed in /etc/shells, or
any executable under hardcoded trusted prefixes (/bin, /usr/bin, /usr/local/bin, /opt/homebrew/bin, /run/current-system/sw/bin).

The selected shell was then executed as a login shell (-l -c 'env -0') for PATH/environment probing.

On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under /opt/homebrew/bin) and runtime $SHELL can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context.

The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in /etc/shells; otherwise it falls back to /bin/sh.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: >= 2026.2.22, <= 2026.2.22-2
Latest published vulnerable version: 2026.2.22-2
Patched versions (released): >= 2026.2.23

Fix Commit(s)

ff10fe8b91670044a6bb0cd85deb736a0ec8fb55

Release Process Note

This advisory sets patched_versions to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-p4wh-cr8m-gm6c

GHSA-p4wh-cr8m-gm6c:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.2.22, < 2026.2.23	2026.2.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the logic for determining a trusted shell for environment variable probing. The function isTrustedShellPath in src/infra/shell-env.ts incorrectly trusted any executable located in a list of hardcoded 'trusted' directory prefixes, such as /opt/homebrew/bin/. An attacker able to place a malicious file in one of these directories and also control the $SHELL environment variable could trick the application into executing it. The function loadShellEnvFallback uses this flawed validation logic via the resolveShell function and then proceeds to execute the shell, leading to arbitrary code execution. The patch removes this insecure fallback, now only trusting shells explicitly listed in /etc/shells. A runtime profiler would likely show loadShellEnvFallback initiating the process and isTrustedShellPath being called to make the faulty trust decision.

Vulnerable functions

isTrustedShellPath

src/infra/shell-env.ts

This function contained the core of the vulnerability. It had a fallback mechanism that would trust a shell executable if its path started with a hardcoded prefix (e.g., '/opt/homebrew/bin/') and the file was executable. This allowed an attacker who could control the '$SHELL' environment variable and write to one of these trusted locations to execute an arbitrary binary.

loadShellEnvFallback

src/infra/shell-env.ts

This function is responsible for orchestrating the loading of the shell environment. It calls the logic that resolves the shell path (which uses the vulnerable 'isTrustedShellPath' function) and then executes the selected shell. During an exploit, this function would appear in the stack trace as it is the one that triggers the execution of the malicious binary.

resolveShell

src/infra/shell-env.ts

This function is called by `loadShellEnvFallback` and is responsible for determining which shell executable to use. It uses the vulnerable `isTrustedShellPath` function to validate the shell path provided by the '$SHELL' environment variable. If `isTrustedShellPath` incorrectly approves a malicious path, `resolveShell` returns that path to be executed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-p4wh-cr8m-gm6c: OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

Summary

Details

Affected Packages / Versions

Fix Commit(s)

Release Process Note

GHSA-p4wh-cr8m-gm6c:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

GHSA-p4wh-cr8m-gm6c: OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

Summary

Details

Affected Packages / Versions

Fix Commit(s)

Release Process Note

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI