AI agent vulnerability · OpenClaw

CVE-2026-4039: OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

mediumCVSS 4.0 5.1GHSA-82g8-464f-2mv7

Summary applySkillConfigEnvOverrides previously copied skills.entries..env values into the host process.env without applying the host env safety policy. Impact In affected versions, dangerous process-level variables such as NODEOPTIONS could be injected when unset, which can influence runtime/child-process behavior.

Published Feb 27, 2026 · Updated Mar 12, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.21
Fixed in: 2026.2.21
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

applySkillConfigEnvOverrides previously copied skills.entries.*.env values into the host process.env without applying the host env safety policy.

Impact

In affected versions, dangerous process-level variables such as NODE_OPTIONS could be injected when unset, which can influence runtime/child-process behavior.

Required attacker capability

An attacker must be able to modify OpenClaw local state/config (for example ~/.openclaw/openclaw.json) to set skills.entries.<skill>.env or related skill config values.

Remediation

Fixed in 2026.2.21 by sanitizing skill env overrides and blocking dangerous host env keys (including NODE_OPTIONS) before applying overrides, with regression tests covering blocked dangerous keys.

Fix Commit(s)

8c9f35cdb51692b650ddf05b259ccdd75cc9a83c

Found using MCPwner

Credited to nedlir.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries