{"id":"CVE-2026-22177","title":"OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars","summary":"OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuratio…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-15"],"vendor":"OpenClaw","product":"OpenClaw","affected":["OpenClaw < 2026.2.21"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-03-18T19:48:30.916488Z"},"published":"2026-03-18","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:01:09.488Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22177","references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8fmp-37rc-p5g7","label":"GitHub Security Advisory (GHSA-8fmp-37rc-p5g7)"},{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w9j9-w4cp-6wgr","label":"GitHub Security Advisory (GHSA-w9j9-w4cp-6wgr)"},{"url":"https://github.com/openclaw/openclaw/commit/2cdbadee1f8fcaa93302d7debbfc529e19868ea4","label":"VulnCheck Advisory: OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars"},{"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-config-env-vars"}],"tags":["cve.org"],"epss":0.00394,"epssPercentile":0.3381,"ingestedAt":"2026-11-08T14:51:22.478Z","slug":"CVE-2026-22177","body":"## Overview\n\nOpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.\n\n## Affected\n\n- `OpenClaw < 2026.2.21`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}