GHSA-j425-whc4-4jgc: OpenClaw system.run Env Override Filtering Allowed Dangerous Helper-Command Pivots

GHSA CVSS Score Platform CWE-15 CWE-639

Keywords: GHSA-j425-whc4-4jgc, OpenClaw vulnerability, system.run env override, sanitizeHostExecEnv bypass, GIT_SSH_COMMAND, helper-command pivot, AI agent security, env override filtering, allowlist bypass, OpenClaw security advisory

• Overview
• Vulnerability Details
• Technical Analysis
• Attack Chain
• Impact
• Remediation
• CVSS Metrics
• Timeline
• References
• Contact

OpenClaw system.run env override filtering allowed dangerous helper-command pivots — The env sanitization in src/infra/host-env-security.ts blocked only a narrow set of override-only environment variables, allowing a tool-enabled caller to steer allowlisted tools through helper-command or config-loading variables like GIT_SSH_COMMAND, editor/pager hooks, and GIT_CONFIG_* / NPM_CONFIG_*.

OpenClaw (187K+ GitHub stars) is a widely deployed personal AI assistant. Its system.run capability allows the agent to execute shell commands on the host machine. Approval evaluation was tied to the reviewed binary/argv, but the launched process could still inherit attacker-controlled env overrides that changed helper-command execution or config resolution — meaning the actual spawned-process behavior diverged from what was approved.

Discovered by: Kai Aizen (@SnailSploit) & @tdjackey Published: March 8, 2026 CVSS Score: 6.3 (Moderate) CWE: CWE-15 (External Control of System or Configuration Setting) + CWE-639 (Authorization Bypass Through User-Controlled Key) Package: openclaw (npm) Patched in: 2026年3月7日

Before the fix, src/infra/host-env-security.ts blocked only a narrow set of override-only environment variables. Dangerous request-scoped overrides such as GIT_SSH_COMMAND and prefix families such as GIT_CONFIG_* and NPM_CONFIG_* could still survive sanitizeSystemRunEnvOverrides(...) / sanitizeHostExecEnv(...) and reach the spawned process.

This mattered for system.run allowlist and approval flows because approval evaluation was tied to the reviewed binary/argv, while the launched process could still inherit attacker-controlled env overrides that changed helper-command execution or config resolution. For allowlisted tools such as git, this allowed behavior outside the reviewed command semantics.

• Vulnerable: All versions ≤ 2026年3月2日
• Patched: Version 2026年3月7日

The core issue is a semantic mismatch between what was reviewed and what actually executes:

1. A caller invokes system.run with env overrides (e.g., { "GIT_SSH_COMMAND": "<payload>" })
2. The allowlist/approval system reviews the binary and argv — git push origin main looks safe
3. sanitizeSystemRunEnvOverrides() / sanitizeHostExecEnv() check against the blocklist
4. GIT_SSH_COMMAND is not blocked — it passes through to the spawned process
5. Git invokes the attacker-controlled GIT_SSH_COMMAND as a helper — executing behavior outside the reviewed command semantics

src/infra/host-env-security.ts → sanitizeSystemRunEnvOverrides()
src/infra/host-env-security.ts → sanitizeHostExecEnv()
src/infra/host-env-security-policy → narrow blocklist (insufficient)

The fix (commit e27bbe4) extends the shared TypeScript and macOS policy to block dangerous override-only exact keys and prefixes while preserving trusted inherited base-environment behavior.

┌─────────────────────────────────────────────────────────────┐
│ 1. Tool-enabled caller invokes system.run with env │
│ overrides: { GIT_SSH_COMMAND: "<payload>" } │
├─────────────────────────────────────────────────────────────┤
│ 2. Allowlist/approval evaluates the binary + argv │
│ "git push origin main" → approved │
├─────────────────────────────────────────────────────────────┤
│ 3. sanitizeHostExecEnv checks blocklist │
│ GIT_SSH_COMMAND → NOT BLOCKED → passes through │
├─────────────────────────────────────────────────────────────┤
│ 4. Spawned git process inherits the env override │
│ Git invokes GIT_SSH_COMMAND as helper │
├─────────────────────────────────────────────────────────────┤
│ 5. Actual behavior diverges from what was approved │
│ Helper-command executes attacker-controlled payload │
└─────────────────────────────────────────────────────────────┘

This is a protection-bypass issue. Exploitation requires an already tool-enabled caller who can invoke system.run and supply env overrides. In affected deployments, that caller could:

• Bypass allowlist/approval intent — trigger helper-command execution not represented by the approved command line
• Hijack config resolution — steer tool behavior through config-loading env vars
• Achieve behavior outside reviewed command semantics — the approved git push becomes something entirely different at runtime

Maintainer severity is set to Moderate because the bug still requires existing execution capability; the vulnerability is the mismatch between reviewed command semantics and actual spawned-process behavior.

Update OpenClaw to version 2026年3月7日 or later:

npm install -g openclaw@latest

• Audit system.run invocations for env override usage
• Prefer allowlist-based env filtering over blocklist approaches
• Monitor subprocess behavior for divergence from approved command semantics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

• GHSA-j425-whc4-4jgc (GitHub Advisory Database)
• GHSA-j425-whc4-4jgc (Repo Advisory)
• Fix Commit e27bbe4
• OpenClaw v2026.3.7 Release
• CWE-15: External Control of System or Configuration Setting
• CWE-639: Authorization Bypass Through User-Controlled Key

Kai Aizen (SnailSploit)

• Web: snailsploit.com
• GitHub: @SnailSploit
• LinkedIn: /in/kaiaizen

⚠️ Disclaimer: This repository is for educational and authorized security research purposes only. Use responsibly.

This project's full writeup, methodology, and related research lives at:

https://snailsploit.com/advisories

Created by Kai Aizen — independent offensive security researcher.

snailsploit.com · Research · Frameworks · GitHub · LinkedIn · ResearchGate · X/Twitter

Same attack. Different substrate.