PT-2026-26738 · Openclaw · Openclaw

Tdjackey · Publicado 2026-03-03 · Atualizado 2026-03-21 · CVE-2026-32056

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description OpenClaw does not properly sanitize shell startup environment variables HOME and ZDOTDIR within the system.run function. This allows attackers to bypass command allowlist protections. By injecting malicious startup files, such as .bash profile or .zshenv, attackers can achieve arbitrary code execution before allowlist-evaluated commands are executed.

Recommendations Update OpenClaw to version 2026.2.22 or later.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-15

CWE-78

Identificadores relacionados

CVE-2026-32056

GHSA-RJ39-33V7-9XRQ

GHSA-XGF2-VXV2-RRMG

Produtos afetados

Openclaw

Referências · 11

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/c2c7114ed39a547ab6276e1e933029b9530ee906 · Correção
• https://twitter.com/CVEnew/status/2035237332195102902 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2035383645175791625 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-xgf2-vxv2-rrmg · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-remote-code-execution-via-shell-startup-environment-variable-injection-in-system-run · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32056 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2035239107782177160 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-rj39-33v7-9xrq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32056 · Aviso do Fabricante