OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

Summary

Exec environment denylist missed high-risk interpreter startup variables.

Affected Packages / Versions

• Package: openclaw
• Ecosystem: npm
• Affected versions: < 2026.4.10
• Patched versions: >= 2026.4.10

Impact

The exec environment policy missed interpreter startup variables such as VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES, allowing operator-supplied environment overrides to influence downstream execution or network behavior.

Technical Details

The fix expands the host environment security policy denylist to cover these and related high-risk environment variables, with regression coverage.

Fix

The issue was fixed in #63277. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

• 2d126fc62343a7b6895351f96e4e1474bc358140
• PR: #63277

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting this issue.