| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.6.6 | 2026.6.6 |
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions beyond the caller's intended authorization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free