An environment variable injection vulnerability in OpenClaw allows authenticated attackers to execute unauthorized commands or manipulate system behavior.

This is an input validation issue categorized as an incomplete list of disallowed inputs (CWE-184). An authenticated attacker can exploit this to inject malicious environment variables into the rustup build process.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for high impact on data and system integrity. An attacker could influence the application environment to bypass security controls or execute arbitrary code, resulting in unauthorized access to sensitive data.

Immediate Action: Update to OpenClaw version 2026.6.6 or later to ensure proper sanitization of input variables.

Proactive Monitoring: Monitor application logs for unusual environment configurations or suspicious calls to build-related processes.

Compensating Controls: Apply strict environment variable isolation and utilize containerization or sandboxing to limit the impact of process-level injections.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of environment injection, this flaw should be addressed immediately. Organizations should verify their current version and update to 2026.6.6 to eliminate the injection vector.