vulnerability · openclaw

Host exec environment filtering could miss interpreter startup variables

Host exec environment filtering could miss interpreter startup variables. The official advisory identifies openclaw <= 2026.6.1 as affected.

high severityconfirmed confidencepatchedNo known exploitation

Quick answer

What defenders need to know

What is it?: Host exec environment filtering could miss interpreter startup variables. The official advisory identifies openclaw <= 2026.6.1 as affected.
Who is affected?: openclaw <= 2026.6.1
What should defenders do?: Upgrade openclaw to 2026.6.6 or later.
Is a fix available?: Yes. Upgrade to 2026.6.6.

01 / Response

Upgrade openclaw to 2026.6.6 or later.
Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed.

02 / Technical assessment

OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-78, CWE-184.

Official advisory: Host exec environment filtering could miss interpreter startup variables.
Affected range: <= 2026.6.1. First patched version: 2026.6.6.

03 / Timeline