GHSA-8fmp-37rc-p5g7 OpenClaw's config env vars allowed startup env injection into service runtime

• npm openclaw: < 2026.2.21 → fixed in 2026.2.21

Summary OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. Details `collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published affected version: `2026.2.19-2` (published February 19, 2026) • Affected range (structured): `= 2026.2.21` Fix Commit(s) • `2cdbadee1f8fcaa93302d7debbfc529e19868ea4` Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits. OpenClaw thanks @tdjackey for reporting.