CVE-2026-32056 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to byp…
High CVSS: 7.7

CVE-2026-32056

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash_profile or .zshenv to achieve arbitrary code execution before allowlist-evaluated commands are executed.
Vendor
Openclaw
Product
Openclaw
CWE
CWE-78
Yayın Tarihi
2026-03-21 01:17:09
Güncelleme
2026-03-23 18:59:59
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-78 Openclaw HIGH Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/c2c7114ed39a547ab6276e1e933029b9530ee906 https://github.com/openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-shell-startup-environment-variable-injection-in-system-run