43 matches found
PT-2026-60164
A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...
OpenClaw OS Command Injection Vulnerability (CNVD-2026-16044)
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability. The vulnerability is caused by failing to filter the shell startup environment variables HOME and ZDOTDIR in the system.run function. An attacker ca...
Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xgf2-vxv2-rrmg. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the...
CVE-2026-32056
OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bashprofile or .zshenv to achieve arbitra...
CVE-2026-32056
OpenClaw prior to version 2026.2.22 is vulnerable to remote code execution via shell startup environment variable injection in system.run. The root cause is failure to sanitize HOME and ZDOTDIR, allowing an attacker to place startup files (e.g., .bash_profile or .zshenv) that are read before allo...
CVE-2026-32056 OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run
OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bashprofile or .zshenv to achieve arbitra...
OpenClaw 操作系统命令注入漏洞
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an operating system command injection vulnerability. The vulnerability is caused by failing to filter the shell startup environment variables HOME and ZDOTDIR in the system.run function. An attacker ca...
PT-2026-26738
OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash profile or .zshenv to achieve...
CVE-1999-0782
KDE kppp allows local users to create a directory in an arbitrary location via the HOME environmental variable...
EUVD-2001-0398
Malware in sbrugna...
EUVD-2001-0672
Malware in sbrugna...
EUVD-1999-1464
Malware in sbrugna...
EUVD-2000-0788
Malware in sbrugna...
EUVD-2019-0092
Malware in sbrugna...
EUVD-2003-0034
Malware in sbrugna...
EUVD-2004-0158
Malware in sbrugna...
EUVD-1999-1515
Malware in sbrugna...
EUVD-2007-0406
Malware in sbrugna...