OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Date: 2026-03
Affected: npm/openclaw
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-15
CWE-78
CVSS: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

### Summary OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.1.5` and `<= 2026.2.21-2` - Fixed on `main`: `9363c320d8ffe29290906752fab92621da02c3f7` - Planned patched release version (pre-set): `2026.2.22` ### Details The vulnerable chain was in the shell-env fallback path: 1. `src/infra/shell-env.ts` - `resolveShell(env)` trusted `env.SHELL` when set. - `execLoginShellEnvZero(...)` executed `${SHELL} -l -c "env -0"` with inherited runtime env. 2. `src/config/io.ts` - Config env values were applied before shell fallback execution. 3. `src/config/env-vars.ts` / env policy coverage - `SHELL` handling was hardened, but startup-path selectors (`HOME`, `ZDOTDIR`) still needed explicit blocking in config env ingestion and sanitization for shell fallback execution. With env/config influence, this could trigger unintended command execution in shell startup processing on the OpenClaw host process context. ### Fix Mainline hardening now: - blocks `SHELL`, `HOME`, and `ZDOTDIR` during config env ingestion used by runtime fallback, - sanitizes shell fallback execution env, pinning `HOME` to the real user home and dropping `ZDOTDIR` + dangerous startup vars, - adds regression tests for config env ingestion and shell fallback/path-probe sanitization. ### Fix Commit(s) - `9363c320d8ffe2929090


Mitigations:

Architectural layers (MAESTRO):