OpenClaw versions between 2026.3.28 (inclusive) and 2026.8.1 (exclusive) allow an attacker to place an untrusted .env file in a workspace and set the CLOUDSDK_PYTHON_ARGS environment variable. When the operator starts OpenClaw from that workspace and initiates the Gmail setup flow, the gcloud launcher inherits the variable and forwards its contents as arguments to the trusted Python interpreter. A crafted value can cause Python to execute arbitrary code with the host user's privileges, enabling the attacker to read credentials, modify files, or launch additional processes. The weakness is catalogued as CWE‑88, reflecting improper handling of user‑supplied configuration data that is executed in a privileged context.

The vulnerability affects any installation of the openclaw npm package (OpenClaw) with a version number >= 2026.3.28 and < 2026.8.1. No other vendor or product versions are affected according to the current data.

With a CVSS score of 8.5 the vulnerability is classified as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so publicly documented exploitation is not confirmed. The attack vector likely requires the attacker to control the workspace content or be able to influence the .env file that sets CLOUDSDK_PYTHON_ARGS. When these conditions are met, the attacker can achieve remote code execution with the permissions of the OpenClaw host user. The absence of an EPSS figure suggests that exploit prevalence may be limited, but the high CVSS score and the ability to run arbitrary code warrant close attention.