https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:42:22.283983+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05062 bdu:2026-05062 2026-10-03T19:42:22.374282+00:00 bdu:2026-05062 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-22177 BREW-openclaw-cli-CVE-2026-22177 — OpenClaw's config env vars allowed startup env injection into service runtime 2026-10-03T19:42:22.374318+00:00

Affected: Homebrew: openclaw-cli

### Summary OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.

### Details `collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published affected version: `2026.2.19-2` (published February 19, 2026) - Affected range (structured): `<=2026.2.19-2 || =2026.2.19` - Patched version (pre-set for next release): `>= 2026.2.21`

### Fix Commit(s) - `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits.

OpenClaw thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/cnvd-2026-16047 cnvd-2026-16047 2026-10-03T19:42:22.374361+00:00 cnvd-2026-16047 https://cve.radiocsirt.org/vuln/euvd-2026-281270 EUVD-2026-281270 2026-10-03T19:42:22.374377+00:00 EUVD-2026-281270 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22177 fkie_cve-2026-22177 2026-10-03T19:42:22.374389+00:00

OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration to execute arbitrary code in the OpenClaw gateway service runtime context.

 https://cve.radiocsirt.org/vuln/ghsa-8fmp-37rc-p5g7 GHSA-8fmp-37rc-p5g7 — OpenClaw's config env vars allowed startup env injection into service runtime 2026-10-03T19:42:22.374411+00:00

Affected: npm: openclaw

### Summary OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.

### Details `collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published affected version: `2026.2.19-2` (published February 19, 2026) - Affected range (structured): `<=2026.2.19-2 || =2026.2.19` - Patched version (pre-set for next release): `>= 2026.2.21`

### Fix Commit(s) - `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits.

OpenClaw thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0472 WID-SEC-W-2026-0472 — OpenClaw: Mehrere Schwachstellen 2026-10-03T19:42:22.374443+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.