PT-2026-24673 · Git+2 · Openclaw

Tdjackey

·

Published

2026-03-03

·

Updated

2026-03-16

·

CVE-2026-32063

CVSS v4.0

8.6

High

VectorAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.19-2 through 2026.2.21
Description OpenClaw contains a command injection issue in the systemd unit file generation process. Attacker-controlled environment values are not properly validated for CR/LF characters, allowing for newline injection. This injection can break out of Environment= lines and introduce arbitrary systemd directives. An attacker who can influence the config.env.vars file and trigger a service install or restart can execute arbitrary commands with the privileges of the OpenClaw gateway service user. The issue stems from insufficient validation of environment keys and values before writing unit lines, and an incorrect whitespace-matching regex in systemdEscapeArg(). The vulnerable code resides in src/daemon/systemd-unit.ts, src/commands/daemon-install-helpers.ts, src/config/env-vars.ts, and src/config/zod-schema.ts. The vulnerability is triggered when an attacker can control config.env.vars, invoke the install/reinstall path, and restart the service using systemctl --user restart. The Environment= parameter is vulnerable, and the systemdEscapeArg() function is involved in the exploitation chain.
Recommendations OpenClaw versions 2026.2.19-2 through 2026.2.21 should be updated to version 2026.2.21 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-32063
GHSA-VFFC-F7R7-RX2W

Affected Products

Openclaw