GHSA-39pp-xp36-q6mg

Suggest an improvement
Source
https://github.com/advisories/GHSA-39pp-xp36-q6mg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-39pp-xp36-q6mg/GHSA-39pp-xp36-q6mg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-39pp-xp36-q6mg
Aliases
  • CVE-2026-35650
Downstream
Published
2026-03-26T19:51:12Z
Modified
2026-04-10T19:50:16.910532Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw has Inconsistent Host Exec Environment Override Sanitization
Details

Summary

Gateway host exec env override handling did not consistently apply the shared host environment policy, so blocked or malformed override keys could slip through inconsistent sanitization paths.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.22
  • Fixed: >= 2026.3.22
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • 7abfff756d6c68d17e21d1657bbacbaec86de232

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • src/infra/host-env-security.ts now provides one shared sanitizer and fail-closed diagnostics for blocked or malformed override keys.
  • src/agents/bash-tools.exec.ts and src/node-host/invoke-system-run.ts both route env overrides through the shared sanitizer before execution.

OpenClaw thanks @zpbrent for reporting.

Database specific 
{
    "cwe_ids": [
        "CWE-15",
        "CWE-693"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-04-10T17:17:05Z",
    "github_reviewed_at": "2026-03-26T19:51:12Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-39pp-xp36-q6mg/GHSA-39pp-xp36-q6mg.json"