CVE-2026-4039: Process Injection in OpenClaw

The core of the vulnerability lies in the applySkillConfigEnvOverrides function, which previously copied environment variables from skill configurations directly into the host process's environment (process.env) without proper sanitization. An attacker who can modify the OpenClaw local state, specifically the ~/.openclaw/openclaw.json file, can inject malicious environment variables. This is particularly concerning because variables like NODE_OPTIONS can directly influence how Node.js applications execute, potentially allowing for arbitrary code execution or denial-of-service. The impact is amplified if OpenClaw is used in environments where untrusted code is executed or where process isolation is critical. Successful exploitation could lead to complete compromise of the affected Node.js process.

1. Reserved2026-03-12
2. Published2026-02-27
3. Modified2026-03-14
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-4039 is to upgrade OpenClaw to version 2026.2.21 or later. This version includes a fix that sanitizes skill configuration data, preventing the injection of malicious environment variables. If upgrading immediately is not feasible, restrict access to the ~/.openclaw/openclaw.json file to prevent unauthorized modification. Consider implementing input validation on any data sources used to populate skill configurations. After upgrading, verify the fix by attempting to inject a known malicious environment variable (e.g., NODE_OPTIONS=--inspect) into the skill configuration and confirming that it is not reflected in the host process's environment.