GHSA-vfw7-6rhc-6xxg CVE-2026-41384

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

High npm

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.14%; Chance of exploitation in the next 30 days. Higher than 3.40% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-15 External Control of System or Configuration Setting; CWE-426 Untrusted Search Path
Fix: 2026.3.24; Upgrade openclaw to this version or later

Description

Summary

Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Current Maintainer Triage

Status: open
Normalized severity: high
Assessment: Real shipped malicious-workspace-config env injection in the CLI backend runner, fixed by sanitizing backend env before spawn and shipped in v2026.3.24, so advisory stays open until published.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.23-2
Patched versions: >= 2026.3.24
First stable tag containing the fix: v2026.3.24

Fix Commit(s)

c2fb7f1948c3226732a630256b5179a60664ec24 — 2026-03-24T12:58:10-07:00

Release Process Note

The fix is already present in released version 2026.3.24.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @YLChen-007 for reporting.

Affected versions

npm

Package	Vulnerable	Fixed in
openclaw	`< 2026.3.24`	`2026.3.24`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → `2026.3.24`

npm

npm install openclaw@2026.3.24

yarn

yarn add openclaw@2026.3.24

pnpm

pnpm add openclaw@2026.3.24

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): High
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-15: External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Implementation, Architecture and Design: Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.
Implementation, Architecture and Design: In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.

CWE-426: Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

How to prevent it

Architecture and Design, Implementation: Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Implementation: When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Implementation: Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Implementation: Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Implementation: Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-41384

Packages

github.com/openclaw/openclaw

Timeline

Apr 7, 2026 Published
Jun 17, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-3x84-qq85-fj65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs	High	Also affects openclaw
GHSA-9c3v-684m-579c OpenClaw MCP SSE redirects could forward Authorization headers	Medium	Also affects openclaw
GHSA-f397-5vjw-v2c2 OpenClaw: Shell inline-command parsing could miss an allowlist check	High	Also affects openclaw
GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection	High	Also affects openclaw
GHSA-ccwh-wwpp-6wg5 OpenClaw: Host environment sanitizer missed two Node.js control variables	High	Also affects openclaw
GHSA-985f-72mj-8gf7 OpenClaw: Tool group policy callers could accept unvalidated group IDs	Medium	Also affects openclaw
GHSA-9v8j-9c9g-w66c OpenClaw: Bootstrap token replay could widen pending pairing scopes	Medium	Also affects openclaw
GHSA-c226-q6fx-6j6c OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags	Medium	Also affects openclaw

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor