---
id: CVE-2026-22177
title: OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars
summary: >-
  OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control
  environment variables from config env.vars, allowing startup-time code
  execution. Attackers can inject variables like NODE_OPTIONS or LD_* through
  configuratio…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-15
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw < 2026.2.21
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-18T19:48:30.916488Z'
published: '2026-03-18'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:09.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22177'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-8fmp-37rc-p5g7
    label: GitHub Security Advisory (GHSA-8fmp-37rc-p5g7)
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-w9j9-w4cp-6wgr
    label: GitHub Security Advisory (GHSA-w9j9-w4cp-6wgr)
  - url: >-
      https://github.com/openclaw/openclaw/commit/2cdbadee1f8fcaa93302d7debbfc529e19868ea4
    label: >-
      VulnCheck Advisory: OpenClaw < 2026.2.21 - Environment Variable Injection
      via Config env.vars
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-config-env-vars
tags:
  - cve.org
epss: 0.00394
epssPercentile: 0.3381
ingestedAt: '2026-11-08T14:51:22.478Z'
---

## Overview

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.

## Affected

- `OpenClaw < 2026.2.21`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.