OpenClaw versions earlier than 2026.2.22 do not sanitize the shell startup environment variables HOME and ZDOTDIR used by the system.run function. This flaw allows an attacker to inject malicious startup files such as .bash_profile or .zshenv. The injected code executes before any command allowlist checks, giving the attacker unrestricted code execution on the host where OpenClaw runs.

All installations of OpenClaw running a version prior to 2026.2.22 are affected, regardless of the operating system, since the vulnerability resides in the core Node.js library. Any environment where the system.run API processes untrusted input can be impacted.

The vulnerability carries a CVSS score of 7.7, indicating high severity. No EPSS score is available and it is not listed in the CISA KEV catalog. The attack vector is remote, targeting the system.run API when it processes untrusted data. Successful exploitation would allow an attacker to execute arbitrary code before any allowlist-based command filtering, effectively compromising the entire system that hosts OpenClaw.