https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:22:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-22177 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.</p> https://vulnerability.circl.lu/vuln/cve-2026-22177 https://vulnerability.circl.lu/vuln/ghsa-8fmp-37rc-p5g7 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.</p> <p>### Details `collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published affected version: `2026.2.19-2` (published February 19, 2026) - Affected range (structured): `&lt;=2026.2.19-2 || =2026.2.19` - Patched version (pre-set for next release): `&gt;= 2026.2.21`</p> <p>### Fix Commit(s) - `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.</p> <p>### Details `collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published affected version: `2026.2.19-2` (published February 19, 2026) - Affected range (structured): `&lt;=2026.2.19-2 || =2026.2.19` - Patched version (pre-set for next release): `&gt;= 2026.2.21`</p> <p>### Fix Commit(s) - `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-8fmp-37rc-p5g7