https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T23:51:19.820569+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-42435 CVE-2026-42435 — OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection 2026-09-28T23:51:19.822187+00:00

Affected: OpenClaw

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and PS4, affecting execution semantics and security controls.

 https://db.gcve.eu/vuln/ghsa-j6c7-3h5x-99g9 GHSA-j6c7-3h5x-99g9 — OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms 2026-09-28T23:51:19.822266+00:00

Affected: npm: openclaw

## Summary

Shell-wrapper detection missed env-argv assignment injection forms.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.2.22 < 2026.4.12` - Patched versions: `>= 2026.4.12`

## Impact

Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could affect execution semantics, including high-risk shell environment controls.

## Technical Details

The fix broadens shell-wrapper detection and blocks environment assignments in argv forms. High-risk shell variables such as `SHELLOPTS` and `PS4` are covered by the host environment security policy.

## Fix

The issue was fixed in #65717. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `8f8492d172f4c5b4fd7dd9a47855ed620c8770ab` - PR: #65717

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @decsecre583 for reporting this issue.