Description
A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a OpenClaw
2026.2.19-2affected2026.2.21-beta.1unaffected
References
- https://vuldb.com/?id.350651 ↗
- https://vuldb.com/?ctiid.350651 ↗
- https://vuldb.com/?submit.769580 ↗
- https://github.com/openclaw/openclaw/security/advisories/GHSA-82g8-464f-2mv7 ↗
- https://github.com/openclaw/openclaw/commit/8c9f35cdb51692b650ddf05b259ccdd75cc9a83c ↗
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.21-beta.1 ↗
- https://github.com/openclaw/openclaw/ ↗