p PatchFirst

CVE-2026-22217

CVE-2026-22217 · OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context.

CVSS 5.8 · Media · EPSS 0,1% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 2026.2.22, < 2026.2.23: Afectada (semver)

    Actualiza a 2026.2.23

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 2026.2.22, < 2026.2.23

    Actualiza a 2026.2.23

Fuentes originales

Comprueba tu servidor →