VYPR
← All advisories
High severity7.8NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-32032

CVE-2026-32032

Description

OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a malicious SHELL variable to execute arbitrary commands with the privileges of the OpenClaw process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.2.222026.2.22

Affected products

3
  • OpenClaw/Openclaw2 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.22
    • (no CPE)range: 0
  • ghsa-coords
    pkg:npm/openclaw
    Range: < 2026.2.22

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.