GHSA-8fmp-37rc-p5g7

Suggest an improvement
Source
https://github.com/advisories/GHSA-8fmp-37rc-p5g7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fmp-37rc-p5g7/GHSA-8fmp-37rc-p5g7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8fmp-37rc-p5g7
Aliases
Downstream
Published
2026-03-03T19:53:02Z
Modified
2026-03-19T18:47:27.692471Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw's config env vars allowed startup env injection into service runtime
Details

Summary

OpenClaw allowed dangerous process-control environment variables from env.vars (for example NODE_OPTIONS, LD_*, DYLD_*) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.

Details

collectConfigEnvVars() accepted unfiltered keys from config and those values were merged into the daemon install environment in buildGatewayInstallPlan(). Before the fix, startup-control variables were not blocked in this path.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published affected version: 2026.2.19-2 (published February 19, 2026)
  • Affected range (structured): <=2026.2.19-2 || =2026.2.19
  • Patched version (pre-set for next release): >= 2026.2.21

Fix Commit(s)

  • 2cdbadee1f8fcaa93302d7debbfc529e19868ea4

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21). Once that npm release is published, this advisory is ready to publish without further content edits.

OpenClaw thanks @tdjackey for reporting.

Database specific 
{
    "cwe_ids": [
        "CWE-15"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2026-03-18T02:16:21Z",
    "severity": "HIGH",
    "github_reviewed_at": "2026-03-03T19:53:02Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.2.21

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fmp-37rc-p5g7/GHSA-8fmp-37rc-p5g7.json"