OpenClaw versions earlier than 2026.6.6 contain a flaw in the host exec component that fails to correctly sanitize environment variables passed to rustup. Because the filtering is incomplete, attackers who can influence the startup environment—either through lower‑trust caller privileges or by manipulating input paths—can inject arbitrary environment variables. These injected variables are then passed to rustup during execution, allowing the attacker to run arbitrary code or persist operations that elevate their privileges beyond the intended scope.

Vulnerable versions of the OpenClaw application, specifically any release before 2026.6.6, are affected. The product runs under a Node.js runtime, and the vulnerability manifests when the application invokes rustup as part of its host execution process. All deployments using these pre‑2026.6.6 releases are potentially impacted until patched.

The CVSS score of 7.7 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is inferred to be a local privilege escalation that requires the ability to influence environment variables for rustup; however, if a remote user can control the environment—such as through a web interface or configuration file—remote exploitation could also be possible. The flaw directly violates CWE‑184, giving an attacker the ability to inject unexpected environment variables that can lead to unauthorized code execution or privilege escalation.