https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:47:04.545558+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-42435 BREW-openclaw-cli-CVE-2026-42435 — OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms 2026-10-04T20:47:04.549210+00:00

Affected: Homebrew: openclaw-cli

## Summary

Shell-wrapper detection missed env-argv assignment injection forms.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.2.22 < 2026.4.12` - Patched versions: `>= 2026.4.12`

## Impact

Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could affect execution semantics, including high-risk shell environment controls.

## Technical Details

The fix broadens shell-wrapper detection and blocks environment assignments in argv forms. High-risk shell variables such as `SHELLOPTS` and `PS4` are covered by the host environment security policy.

## Fix

The issue was fixed in #65717. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `8f8492d172f4c5b4fd7dd9a47855ed620c8770ab` - PR: #65717

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @decsecre583 for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308667 EUVD-2026-308667 2026-10-04T20:47:04.549299+00:00 EUVD-2026-308667 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42435 fkie_cve-2026-42435 2026-10-04T20:47:04.549316+00:00

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and PS4, affecting execution semantics and security controls.

 https://cve.radiocsirt.org/vuln/ghsa-j6c7-3h5x-99g9 GHSA-j6c7-3h5x-99g9 — OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms 2026-10-04T20:47:04.549354+00:00

Affected: npm: openclaw

## Summary

Shell-wrapper detection missed env-argv assignment injection forms.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `>= 2026.2.22 < 2026.4.12` - Patched versions: `>= 2026.4.12`

## Impact

Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could affect execution semantics, including high-risk shell environment controls.

## Technical Details

The fix broadens shell-wrapper detection and blocks environment assignments in argv forms. High-risk shell variables such as `SHELLOPTS` and `PS4` are covered by the host environment security policy.

## Fix

The issue was fixed in #65717. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `8f8492d172f4c5b4fd7dd9a47855ed620c8770ab` - PR: #65717

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @decsecre583 for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T20:47:04.549389+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.