High-Risk Interpreter Variable Override Vulnerability in OpenClaw
Summary
GHSA-xrgf-r9gr-jjjf: Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables. Affects openclaw versions < 2026.4.10. Fixed in 2026.4.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source package designed for executing commands in a controlled environment. It provides a framework for managing execution policies and environment variables. However, prior to version 2026.4.10, OpenClaw had a vulnerability in its exec environment policy that allowed attackers to manipulate high-risk interpreter startup variables, potentially leading to unauthorized command execution or network access.
Vulnerability Detail
The vulnerability in OpenClaw arises from an insufficient denylist for environment variables in its execution policy. This flaw allows operators to override critical interpreter startup variables such as VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this vulnerability by setting these variables to malicious values, which can alter the behavior of the application or facilitate unauthorized access to network resources. The potential ramifications include data leakage, unauthorized command execution, and disruption of service.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.4.10
This is the first release that contains the fix.
npm install openclaw@2026.4.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually restrict the use of high-risk interpreter startup variables in your environment by unsetting them before executing OpenClaw commands. For example, you can run the following commands in your terminal: unset VIMINIT; unset EXINIT; unset LUA_INIT; unset HOSTALIASES. However, this is not a permanent solution and updating the package is recommended.
Conclusion
The OpenClaw package has a significant vulnerability related to its exec environment policy, allowing for the manipulation of critical interpreter startup variables. It is crucial to update to version 2026.4.10 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability has a CVSS score of 8.8, indicating a high level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized command execution, data leakage, and disruption of service.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities using just your package-lock.json file.
If immediate updates are not possible, ensure to unset the high-risk environment variables as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.