CVE-2026-32056

7.5 HIGH
Published: March 21, 2026 Modified: March 23, 2026
View on NVD

Description

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash_profile or .zshenv to achieve arbitrary code execution before allowlist-evaluated commands are executed.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/openclaw/openclaw/commit/c2c7114ed39a547ab6276e1e933029b9530ee906
Source: disclosure@vulncheck.com
Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg
Source: disclosure@vulncheck.com
Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-shell-startup-environment-variable-injection-in-system-run
Source: disclosure@vulncheck.com
Third Party Advisory

3 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
0.1%
35th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-78

Affected Vendors

openclaw

Related CVEs

CVE-2026-6579 6.5
CVE-2026-6578 5.6
CVE-2026-6577 7.3
CVE-2026-6576 6.3
CVE-2026-6574 7.3