vulnerability · openclaw
Host exec environment filtering could miss rustup startup variables
Host exec environment filtering could miss rustup startup variables. The official advisory identifies openclaw <= 2026.6.2 as affected.
high severityconfirmed confidencepatchedNo known exploitation
Quick answer
What defenders need to know
- What is it?
- Host exec environment filtering could miss rustup startup variables. The official advisory identifies openclaw <= 2026.6.2 as affected.
- Who is affected?
- openclaw <= 2026.6.2
- What should defenders do?
- Upgrade openclaw to 2026.6.6 or later.
- Is a fix available?
- Yes. Upgrade to 2026.6.6.
01 / Response
What to do
- Upgrade openclaw to 2026.6.6 or later.
- Until upgraded, restrict the affected feature to trusted operators or disable it when it is not needed.
02 / Technical assessment
Evidence-backed analysis
OpenClaw's official security advisory assigns high severity with CVSS 8.8 and references CWE-94, CWE-184, CWE-426.
- Official advisory: Host exec environment filtering could miss rustup startup variables.
- Affected range: <= 2026.6.2. First patched version: 2026.6.6.
03 / Timeline
Disclosure timeline
- Advisory published
OpenClaw published GHSA-wxh3-g47h-q3mc.
04 / Standards crosswalk
Standards crosswalk
FrameworkControl IDStatusEvidence
Control ID
CWE-94weakness referenceStatusSupported
Control ID
CWE-184weakness referenceStatusSupported
Control ID
CWE-426weakness referenceStatusSupported
05 / Primary sources