### Summary `shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. ### Details In affected versions, shell selection accepted either: 1. a shell listed in `/etc/shells`, or 2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`). The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing. On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context. The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.22, <= 2026.2.22-2` - Latest published vulnerable version: `2026.2.22-2` - Patched versions (released): `>= 2026.2.23` ### Fix Commit(s) - `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55` ### Release Process Note This advisory sets `patched_versions` to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
### Summary `shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. ### Details In affected versions, shell selection accepted either: 1. a shell listed in `/etc/shells`, or 2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`). The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing. On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context. The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.22, <= 2026.2.22-2` - Latest published vulnerable version: `2026.2.22-2` - Patched versions (released): `>= 2026.2.23` ### Fix Commit(s) - `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55` ### Release Process Note This advisory sets `patched_versions` to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
### Summary `shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. ### Details In affected versions, shell selection accepted either: 1. a shell listed in `/etc/shells`, or 2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`). The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing. On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context. The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.22, <= 2026.2.22-2` - Latest published vulnerable version: `2026.2.22-2` - Patched versions (released): `>= 2026.2.23` ### Fix Commit(s) - `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55` ### Release Process Note This advisory sets `patched_versions` to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
### Summary `shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. ### Details In affected versions, shell selection accepted either: 1. a shell listed in `/etc/shells`, or 2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`). The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing. On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context. The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.22, <= 2026.2.22-2` - Latest published vulnerable version: `2026.2.22-2` - Patched versions (released): `>= 2026.2.23` ### Fix Commit(s) - `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55` ### Release Process Note This advisory sets `patched_versions` to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
Update openclaw to 2026.2.23 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL affects openclaw (npm). Severity is medium. ### Summary `shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. ### Details In affected versions, shell selection accepted either: 1. a shell listed in `/etc/shells`, or 2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`). The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing. On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context. The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.22, <= 2026.2.22-2` - Latest published vulnerable version: `2026.2.22-2` - Patched versions (released): `>= 2026.2.23` ### Fix Commit(s) - `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55` ### Release Process Note This advisory sets `patched_versions` to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| openclawnpm | >=2026.2.22,<2026.2.23 | 2026.2.23 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate openclaw to 2026.2.23 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL affects openclaw (npm). Severity is medium. ### Summary `shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios. ### Details In affected versions, shell selection accepted either: 1. a shell listed in `/etc/shells`, or 2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`). The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing. On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context. The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.22, <= 2026.2.22-2` - Latest published vulnerable version: `2026.2.22-2` - Patched versions (released): `>= 2026.2.23` ### Fix Commit(s) - `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55` ### Release Process Note This advisory sets `patched_versions` to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`. OpenClaw thanks @tdjackey for reporting.
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| openclawnpm | >=2026.2.22,<2026.2.23 | 2026.2.23 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard