OpenClaw components before 2026.4.10 contain a deficiency in the exec environment policy that permits operators to override high‑risk interpreter startup variables such as VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. The attack allows an adversary to influence downstream execution behavior or network connectivity by injecting or modifying these environment variables. The result is the potential execution of arbitrary code or alteration of network configuration, impacting confidentiality, integrity, and availability of the affected system.

The vendor and product affected are OpenClaw:OpenClaw. All releases before 2026.4.10 are vulnerable, irrespective of operating system or deployment method.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation yet. However, the nature of the flaw—environment variable manipulation leading to code execution—suggests that a determined attacker could exploit this flaw if the vulnerable exec policy is active. The likely attack vector involves supply‑chain or local operator compromise, where the attacker can set the variables before a process starts.