PT-2026-24944 · Openclaw · Openclaw

Nedlir · Published 2026-02-27 · Updated 2026-04-07 · CVE-2026-4039

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.19-2

Description A flaw exists in the applySkillConfigenvOverrides function within the Skill Env Handler component. This issue allows for code injection when a manipulation is executed remotely. The issue arises because the function copies skills.entries.*.env values into the host process.env without applying host environment safety policies, potentially allowing injection of dangerous process-level variables like NODE OPTIONS. An attacker must be able to modify OpenClaw local state or configuration to set skills.entries.<skill>.env or related skill config values.

Recommendations Upgrade to OpenClaw version 2026.2.21-beta.1 to resolve this issue.

Fix

Special Elements Injection

Multiple Releases of Same Resource or Handle

Code Injection

Weakness Enumeration

CWE-74

CWE-1341

CWE-94

CWE-15

Related Identifiers

CVE-2026-4039

GHSA-82G8-464F-2MV7

GHSA-WGX8-R9VW-2W4H

Affected Products

Openclaw

References · 16

• https://github.com/openclaw/openclaw/releases/tag/v2026.2.21-beta.1 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-82g8-464f-2mv7 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/8c9f35cdb51692b650ddf05b259ccdd75cc9a83c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4039 · Security Note
• https://osv.dev/vulnerability/GHSA-82g8-464f-2mv7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4039 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wgx8-r9vw-2w4h · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.21 · Note
• https://vuldb.com/?submit.769580 · Note
• https://twitter.com/dailycve/status/2041596225674199511 · Twitter Post
• https://t.me/CVEtracker/47251 · Telegram Post
• https://vuldb.com/?id.350651 · Note
• https://twitter.com/CVEnew/status/2032410968106672239 · Twitter Post
• https://t.me/cveNotify/155253 · Telegram Post