{"data":{"id":"5fe9c0c8-851d-4abe-9258-a1e20452dba2","title":"GHSA-vfp4-8x56-j7c5: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables","summary":"OpenClaw's exec environment policy did not block interpreter startup variables such as VIMINIT, EXINIT, LUA_INIT and HOSTALIASES. Operator-supplied overrides of these variables could influence downstream execution or network behavior in affected versions below 2026.4.10. The fix expands the host environment security policy denylist to cover these and related high-risk variables.","solution":"Upgrade openclaw to 2026.4.10 or newer. The fix is in #63277 and the latest npm release, 2026.4.14, already includes it.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-vfp4-8x56-j7c5","publishedAt":"2026-04-17T21:54:20.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.4.10 (fixed: 2026.4.10)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-vfp4-8x56-j7c5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-17T21:54:20.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null}}