CVE-2026-22177 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution.…
Medium CVSS: 6.9

CVE-2026-22177

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.
Vendor
Openclaw
Product
Openclaw
CWE
CWE-15
Yayın Tarihi
2026-03-18 02:16:21
Güncelleme
2026-03-19 16:07:28
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-15 Openclaw MEDIUM Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/2cdbadee1f8fcaa93302d7debbfc529e19868ea4 https://github.com/openclaw/openclaw/security/advisories/GHSA-8fmp-37rc-p5g7 https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-config-env-vars