GitHub Advisoryadvisory · npm
GHSA-j6c7-3h5x-99g9 OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
MEDIUM
Official page ↗
- Aliases
- CVE-2026-42435
- Ecosystem
- npm
- Packages
- openclaw
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-78
- Reviewed
- 2026-04-17
Affected packages
• npm openclaw: >= 2026.2.22, < 2026.4.12 → fixed in 2026.4.12
Description
Summary
Shell-wrapper detection missed env-argv assignment injection forms.
Affected Packages / Versions
• Package: `openclaw`
• Ecosystem: npm
• Affected versions: `>= 2026.2.22 = 2026.4.12`
Impact
Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could affect execution semantics, including high-risk shell environment controls.
Technical Details
The fix broadens shell-wrapper detection and blocks environment assignments in argv forms. High-risk shell variables such as `SHELLOPTS` and `PS4` are covered by the host environment security policy.
Fix
The issue was fixed in #65717. The first stable tag containing the fix is `v2026.4.12`, and `[email protected]` includes the fix.
Fix Commit(s)
• `8f8492d172f4c5b4fd7dd9a47855ed620c8770ab`
• PR: #65717
Release Process Note
Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.
Credits
Thanks to @decsecre583 for reporting this issue.
Related
Alias · CVE (1)
- CVE-2026-42435 OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to… vulnerability
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness