CVE-2026-22177 — OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars
OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inj…
Published: 2026-03-18 · CVSS: 6.9 · CVSS 4.0
OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7