OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
Summary
shell-env fallback trusted prefix-based executable paths for $SHELL, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios.
Details
In affected versions, shell selection accepted either:
- a shell listed in
/etc/shells, or - any executable under hardcoded trusted prefixes (
/bin,/usr/bin,/usr/local/bin,/opt/homebrew/bin,/run/current-system/sw/bin).
The selected shell was then executed as a login shell (-l -c 'env -0') for PATH/environment probing.
On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under /opt/homebrew/bin) and runtime $SHELL can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context.
The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in /etc/shells; otherwise it falls back to /bin/sh.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
>= 2026.2.22, <= 2026.2.22-2 - Latest published vulnerable version:
2026.2.22-2 - Patched versions (released):
>= 2026.2.23
Fix Commit(s)
ff10fe8b91670044a6bb0cd85deb736a0ec8fb55
Release Process Note
This advisory sets patched_versions to the released version (2026.2.23).
This advisory now reflects released fix version 2026.2.23.
OpenClaw thanks @tdjackey for reporting.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | >= 2026.2.22, < 2026.2.23 | 2026.2.23 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-p4wh-cr8m-gm6c
- https://nvd.nist.gov/vuln/detail/CVE-2026-22217
- https://github.com/openclaw/openclaw/commit/ff10fe8b91670044a6bb0cd85deb736a0ec8fb55
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-arbitrary-binary-execution-via-shell-environment-variable-trusted-prefix-fallback
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L- Weakness (CWE)
CWE-184, CWE-829- Platform
- npm
- Package
openclaw- Disclosed
- 03.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-p4wh-cr8m-gm6c - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 588
- First → latest
- 02.2026 07.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 299
- Low 54
Disclosures per year
- 2026: 588
-
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.