GitHub Advisoryadvisory · npm

GHSA-mj59-h3q9-ghfh OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

MEDIUM Published 2026-04-25 Modified 2026-05-19 Official page ↗
Aliases
CVE-2026-44995
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-427, CWE-454, CWE-829
Reviewed
2026-04-25

Affected packages

• npm openclaw: < 2026.4.20 → fixed in 2026.4.20

Description

Affected Packages / Versions • Package: `openclaw` (npm) • Affected versions: `< 2026.4.20` • Patched version: `2026.4.20` Impact Workspace MCP stdio configuration could pass dangerous process-startup environment variables such as `NODE_OPTIONS`, `LD_PRELOAD`, or `BASH_ENV` to the spawned MCP server process. In a malicious workspace, this could make the MCP child load attacker-controlled code when the operator starts a session that uses that MCP server. The impact is limited to local/workspace trust boundaries and requires the operator to run OpenClaw in a workspace containing the malicious MCP configuration. Severity is therefore medium, not high/critical. Fix OpenClaw now filters MCP stdio environment entries through the host environment safety denylist before spawning stdio MCP servers. Fix commits: • `62fa5071896e95edc7f67d1cebc70a2859e283af` • `85d86ebc4bf3d2226d39d132a484f4f7a299fa1b` Release Fixed in OpenClaw `2026.4.20`.

Related

Alias · CVE (1)

  • CVE-2026-44995 OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows… vulnerability

Weakness · CWE (3)

  • CWE-427 Uncontrolled Search Path Element weakness
  • CWE-454 External Initialization of Trusted Variables or Data Stores weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References