N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vfw7-6rhc-6xxg

GHSA-vfw7-6rhc-6xxg: OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Summary

Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Current Maintainer Triage

Status: open
Normalized severity: high
Assessment: Real shipped malicious-workspace-config env injection in the CLI backend runner, fixed by sanitizing backend env before spawn and shipped in v2026.3.24, so advisory stays open until published.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.23-2
Patched versions: >= 2026.3.24
First stable tag containing the fix: v2026.3.24

Fix Commit(s)

c2fb7f1948c3226732a630256b5179a60664ec24 — 2026-03-24T12:58:10-07:00

Release Process Note

The fix is already present in released version 2026.3.24.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @YLChen-007 for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vfw7-6rhc-6xxg

GHSA-vfw7-6rhc-6xxg:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.23-2	2026.3.24

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch c2fb7f1948c3226732a630256b5179a60664ec24 clearly indicates that the vulnerability lies within the runCliAgent function in the file src/agents/cli-runner.ts. The vulnerability is an environment variable injection vector. Before the patch, the function would unsafely merge environment variables from the workspace configuration (backend.env) into the environment of a new process. This allowed a malicious actor to define a workspace with a crafted configuration that could override critical environment variables like LD_PRELOAD or NODE_OPTIONS, resulting in arbitrary code execution. The patch mitigates this by introducing a new function, sanitizeHostExecEnv, which is called to sanitize the environment variables from the configuration before they are used to spawn the new process. The added test cases in src/agents/cli-runner.test.ts explicitly demonstrate the intended sanitization of dangerous variables like NODE_OPTIONS and LD_PRELOAD, confirming the nature of the vulnerability and the fix.

Vulnerable functions

runCliAgent

src/agents/cli-runner.ts

The `runCliAgent` function was vulnerable to environment variable injection. It directly merged environment variables from the workspace configuration (`backend.env`) with the process's environment variables (`process.env`). This allowed a malicious workspace configuration to set dangerous environment variables (e.g., `LD_PRELOAD`, `NODE_OPTIONS`), leading to arbitrary code execution when a CLI-based agent was executed. The patch replaces this direct merge with a call to `sanitizeHostExecEnv` to filter out potentially harmful variables.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.