CVE-2026-22177 OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODEOPTIONS or LD through configuration to execute arbitrary code in the OpenClaw gateway service...

GHSA-8FMP-37RC-P5G7 OpenClaw's config env vars allowed startup env injection into service runtime

Summary OpenClaw allowed dangerous process-control environment variables from env.vars for example NODEOPTIONS, LD, DYLD to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. Details collectConfigEnvVars accepted unfiltered keys...

OpenClaw's config env vars allowed startup env injection into service runtime

Summary OpenClaw allowed dangerous process-control environment variables from env.vars for example NODEOPTIONS, LD, DYLD to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. Details collectConfigEnvVars accepted unfiltered keys...

com.github.j5ik2o:grpc-gateway-runtime_2.12 (>=1.0.0, <=1.0.3), com.github.j5ik2o:grpc-gateway-runtime_2.13 (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.19.4)

org.webjars:swagger-ui MAVEN version 3.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.github.j5ik2o:grpc-gateway-runtime2.12 =1.0.0, =1.0.0, =2.0.11, =2.1.2 Source cves: CVE-2018-25031 Source...