PT-2026-26738 · Openclaw · Openclaw

Tdjackey · Published 2026-03-03 · Updated 2026-03-21 · CVE-2026-32056

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description OpenClaw does not properly sanitize shell startup environment variables HOME and ZDOTDIR within the system.run function. This allows attackers to bypass command allowlist protections. By injecting malicious startup files, such as .bash profile or .zshenv, attackers can achieve arbitrary code execution before allowlist-evaluated commands are executed.

Recommendations Update OpenClaw to version 2026.2.22 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-15

CWE-78

Related Identifiers

CVE-2026-32056

GHSA-RJ39-33V7-9XRQ

GHSA-XGF2-VXV2-RRMG

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/c2c7114ed39a547ab6276e1e933029b9530ee906 · Patch
• https://osv.dev/vulnerability/GHSA-xgf2-vxv2-rrmg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32056 · Security Note
• https://osv.dev/vulnerability/GHSA-rj39-33v7-9xrq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32056 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2035237332195102902 · Twitter Post
• https://twitter.com/RedPacketSec/status/2035383645175791625 · Twitter Post
• https://vulncheck.com/advisories/openclaw-remote-code-execution-via-shell-startup-environment-variable-injection-in-system-run · Note
• https://twitter.com/infoflowcloud/status/2035239107782177160 · Twitter Post