8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xrgf-r9gr-jjjf

GHSA-xrgf-r9gr-jjjf: Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vfp4-8x56-j7c5. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this by manipulating these environment variables to influence downstream execution behavior or network connectivity.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xrgf-r9gr-jjjf

GHSA-xrgf-r9gr-jjjf:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenClaw stems from an incomplete denylist for environment variables that are passed to child processes. An attacker could provide specially crafted environment variables (like VIMINIT, EXINIT, LUA_INIT, HOSTALIASES) that would not be filtered by the old sanitization logic. These variables could then be interpreted by other programs called during execution, leading to arbitrary code execution or other malicious behavior.

The patch addresses this by expanding the denylist of dangerous environment variables and introducing a new, stricter sanitization function, isDangerousHostInheritedEnvVarName. The vulnerable functions identified were all using the previous, less secure check (isDangerousHostEnvVarName or isBlocked) and were updated to use the new, more comprehensive one. Any runtime profile of an exploit would show one of these sanitization functions failing to remove the malicious environment variable before process execution.

Vulnerable functions

sanitizeHostBaseEnv

src/agents/bash-tools.exec-runtime.ts

This function was responsible for sanitizing the base environment variables. Before the patch, it used the 'isDangerousHostEnvVarName' function, which contained an incomplete denylist. This allowed malicious environment variables to be passed to the execution environment.

validateHostEnv

src/agents/bash-tools.exec-runtime.ts

This function validated the host environment variables and was supposed to throw an error for any forbidden variables. It used the same flawed 'isDangerousHostEnvVarName' function, thus failing to detect and block malicious environment variables.

sanitizeHostExecEnvWithDiagnostics

src/infra/host-env-security.ts

This is a core function for sanitizing environment variables before execution. It was using the weaker 'isDangerousHostEnvVarName' check, which has been replaced by the stricter 'isDangerousHostInheritedEnvVarName' to cover more dangerous variables.

HostEnvSanitizer.sanitize

apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift

This is the Swift implementation of the environment sanitizer for macOS. It was using an insufficiently strict check ('isBlocked') to filter environment variables. The patch replaces this with 'isBlockedInherited' which uses a more comprehensive denylist.

sanitizeHostExecEnv

src/infra/host-env-security.ts

This function is a wrapper around the vulnerable 'sanitizeHostExecEnvWithDiagnostics' function. Although not directly patched, it is part of the vulnerable code path as it calls the function that contained the flaw.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.