p PatchFirst

CVE-2026-22217

CVE-2026-22217 · OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context.

CVSS 5.8 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 2026.2.22, < 2026.2.23: Affected (semver)

    Update to 2026.2.23

  • openclaw npm

    Affected ranges
    • SEMVER: ≥ 2026.2.22, < 2026.2.23

    Update to 2026.2.23

Original sources

Check your server →