OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Summary

Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Current Maintainer Triage

• Status: open
• Normalized severity: high
• Assessment: Real shipped malicious-workspace-config env injection in the CLI backend runner, fixed by sanitizing backend env before spawn and shipped in v2026.3.24, so advisory stays open until published.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.23-2
• Patched versions: >= 2026.3.24
• First stable tag containing the fix: v2026.3.24

Fix Commit(s)

• c2fb7f1948c3226732a630256b5179a60664ec24 — 2026-03-24T12:58:10-07:00

Release Process Note

• The fix is already present in released version 2026.3.24.
• This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @YLChen-007 for reporting.