GitHub Advisoryadvisory · npm

GHSA-vfp4-8x56-j7c5 OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

HIGH Published 2026-04-17 Modified 2026-05-12 Official page ↗
Aliases
CVE-2026-43584
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-184
Reviewed
2026-04-17

Affected packages

• npm openclaw: < 2026.4.10 → fixed in 2026.4.10

Description

Summary Exec environment denylist missed high-risk interpreter startup variables. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `= 2026.4.10` Impact The exec environment policy missed interpreter startup variables such as `VIMINIT`, `EXINIT`, `LUA_INIT`, and `HOSTALIASES`, allowing operator-supplied environment overrides to influence downstream execution or network behavior. Technical Details The fix expands the host environment security policy denylist to cover these and related high-risk environment variables, with regression coverage. Fix The issue was fixed in #63277. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix. Fix Commit(s) • `2d126fc62343a7b6895351f96e4e1474bc358140` • PR: #63277 Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. Credits Thanks to @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-43584 OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows… vulnerability

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References