https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:14:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-4039 <p><strong>Affected:</strong> OpenClaw</p> <p>A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component.</p> https://vulnerability.circl.lu/vuln/cve-2026-4039 https://vulnerability.circl.lu/vuln/ghsa-82g8-464f-2mv7 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary `applySkillConfigEnvOverrides` previously copied `skills.entries.*.env` values into the host `process.env` without applying the host env safety policy.</p> <p>### Impact In affected versions, dangerous process-level variables such as `NODE_OPTIONS` could be injected when unset, which can influence runtime/child-process behavior.</p> <p>### Required attacker capability An attacker must be able to modify OpenClaw local state/config (for example `~/.openclaw/openclaw.json`) to set `skills.entries.&lt;skill&gt;.env` or related skill config values.</p> <p>### Remediation Fixed in `2026.2.21` by sanitizing skill env overrides and blocking dangerous host env keys (including `NODE_OPTIONS`) before applying overrides, with regression tests covering blocked dangerous keys.</p> <p>## Fix Commit(s) - `8c9f35cdb51692b650ddf05b259ccdd75cc9a83c`</p> <p>Found using [MCPwner](https://github.com/Pigyon/MCPwner)</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary `applySkillConfigEnvOverrides` previously copied `skills.entries.*.env` values into the host `process.env` without applying the host env safety policy.</p> <p>### Impact In affected versions, dangerous process-level variables such as `NODE_OPTIONS` could be injected when unset, which can influence runtime/child-process behavior.</p> <p>### Required attacker capability An attacker must be able to modify OpenClaw local state/config (for example `~/.openclaw/openclaw.json`) to set `skills.entries.&lt;skill&gt;.env` or related skill config values.</p> <p>### Remediation Fixed in `2026.2.21` by sanitizing skill env overrides and blocking dangerous host env keys (including `NODE_OPTIONS`) before applying overrides, with regression tests covering blocked dangerous keys.</p> <p>## Fix Commit(s) - `8c9f35cdb51692b650ddf05b259ccdd75cc9a83c`</p> <p>Found using [MCPwner](https://github.com/Pigyon/MCPwner)</p> https://vulnerability.circl.lu/vuln/ghsa-82g8-464f-2mv7