Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-8fmp-37rc-p5g7
Advisory ID github_osv/GHSA-8fmp-37rc-p5g7
Aliases CVE-2026-22177
Summary OpenClaw's config env vars allowed startup env injection into service runtime ### Summary OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. ### Details `collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published affected version: `2026.2.19-2` (published February 19, 2026) - Affected range (structured): `<=2026.2.19-2 || =2026.2.19` - Patched version (pre-set for next release): `>= 2026.2.21` ### Fix Commit(s) - `2cdbadee1f8fcaa93302d7debbfc529e19868ea4` ### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits. OpenClaw thanks @tdjackey for reporting.
Status Published
Exploitability 0.5
Weighted Severity 7.9
Risk 4.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-15 External Control of System or Configuration Setting
System Score Found at
cvssv3.1 8.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fmp-37rc-p5g7/GHSA-8fmp-37rc-p5g7.json
cvssv4 6.9 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fmp-37rc-p5g7/GHSA-8fmp-37rc-p5g7.json
generic_textual MODERATE
Reference id Reference type URL
https://github.com/openclaw/openclaw
2cdbadee1f8fcaa93302d7debbfc529e19868ea4 Other https://github.com/openclaw/openclaw/commit/2cdbadee1f8fcaa93302d7debbfc529e19868ea4
CVE-2026-22177 https://nvd.nist.gov/vuln/detail/CVE-2026-22177
GHSA-8fmp-37rc-p5g7 Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-8fmp-37rc-p5g7
GHSA-w9j9-w4cp-6wgr Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-w9j9-w4cp-6wgr
openclaw-environment-variable-injection-via-config-env-vars Advisory https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-config-env-vars
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fmp-37rc-p5g7/GHSA-8fmp-37rc-p5g7.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8fmp-37rc-p5g7/GHSA-8fmp-37rc-p5g7.json
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-18T19:48:30Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22177.json

Source Advisory: vulnrichment/CVE-2026-22177

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]