PT-2026-35805 · Openclaw · Openclaw

Boyhack · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-42427

Mitre

CVSS v3.1

5.3

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO BUILD RUSTC WRAPPER, RUSTC WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary code execution.

Fix

RCE

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-42427

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7437-7hg8-frrw · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42427 · Security Note
• https://vulncheck.com/advisories/openclaw-remote-code-execution-via-build-tool-environment-variable-injection · Note
• https://twitter.com/CVEnew/status/2049227497154216162 · Twitter Post