OpenClaw versions before 2026.3.22 contain an inconsistency in the sanitization of environment variable overrides. Attackers can craft blocked or malformed override keys that slip through the validation logic, allowing them to inject arbitrary environment variables. When these overridden variables are applied during server execution, they enable the attacker to execute arbitrary code within the OpenClaw process context, compromising confidentiality, integrity, and availability of the host system.

The vulnerability affects the OpenClaw application, distributed as the product OpenClaw. All installations running any release prior to 2026.3.22 are susceptible. The issue is present in the Node.js based deployment of the software where environment variables are parsed during startup.

The CVSS score of 7.7 indicates a high severity impact. No EPSS score is publicly available, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is inferred to be remote because an attacker can influence environment variable overrides through external interfaces such as configuration files, API endpoints, or deployment scripts. Successful exploitation would allow arbitrary code execution with the privileges of the running OpenClaw process.