Nixpkgs Security Tracker

Untriaged

Permalink CVE-2026-22177

6.1 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): HIGH
Availability impact (A): LOW

created 4 days, 1 hour ago

OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.

References

GitHub Security Advisory (GHSA-8fmp-37rc-p5g7) third-party-advisory
Patch Commit patch
VulnCheck Advisory: OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars third-party-advisory

Affected products

OpenClaw

==2026.2.21
<2026.2.21

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

nixos-unstable 2026.3.12
- nixpkgs-unstable 2026.3.12
- nixos-unstable-small 2026.3.12

Package maintainers

@chrisportela Chris Portela <chris@chrisportela.com>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.openclaw

Package maintainers