An environment variable injection vulnerability in OpenClaw allows attackers to manipulate workspace configurations to achieve code execution or sensitive data exposure.

This vulnerability, categorized as CWE-15, stems from insufficient sanitization of workspace configuration settings in the CLI backend. An attacker can inject malicious environment variables, which are then processed by the backend during the spawning of sub-processes, allowing for unauthorized system manipulation.

The potential for code execution and the exposure of sensitive data poses a severe risk to organizational security. Given the CVSS score of 7.8, this vulnerability is classified as High, indicating that successful exploitation could lead to full system compromise, loss of data integrity, and significant operational disruption.

Immediate Action: Update the OpenClaw package to version 2026.3.24 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review system logs and workspace configuration files for unusual entries or unexpected process spawning patterns.

Compensating Controls: Restrict access to workspace configuration files and ensure that the CLI runner is executed within a containerized or restricted environment to limit the impact of potential environment variable manipulation.

Public Exploit Available: No — exploit_available (false).

The severity of this issue necessitates prompt action to protect the integrity of the development environment. Organizations should prioritize patching OpenClaw to the latest version to eliminate the risk of environment variable injection and the subsequent potential for remote code execution.