CVE-2026-62203CWE-184

CVE-2026-62203

High · published July 17, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization level.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-07-17T06:18Z
Affected products (1)
ProductVersionsFixed in
openclaw/openclaw< 2026.6.62026.6.6
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-wxh3-g47h-q3mc · [email protected]https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-rustup · [email protected]
EPSS history
Timeline
  • 17 JUL 00:06Z
    OpenClaw < 2026.6.6 Environment Variable Injection via rustup
    cvelistv5