GHSA-8fmp-37rc-p5g7: OpenClaw's config env vars allowed startup env injection into service runtime

March 3, 2026

OpenClaw allowed dangerous process-control environment variables from env.vars (for example NODE_OPTIONS, LD_*, DYLD_*) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.

References

github.com/advisories/GHSA-8fmp-37rc-p5g7
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/2cdbadee1f8fcaa93302d7debbfc529e19868ea4
github.com/openclaw/openclaw/security/advisories/GHSA-8fmp-37rc-p5g7

Code Behaviors & Features

Detect and mitigate GHSA-8fmp-37rc-p5g7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →