Openclaw cli: OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux) (CVE-2026-32063)

CVE-2026-32063 is a command injection vulnerability in OpenClaw CLI's Linux systemd unit generation path. The vulnerability occurs because the function rendering `Environment=` entries does not reject carriage return or line feed characters in environment keys or values. Additionally, the `systemdEscapeArg()` function uses an incorrect regex that fails to detect whitespace properly, allowing newline injection to break out of the `Environment=` line and inject standalone systemd directives such as `ExecStartPre=`. Upon service restart, systemd executes the injected commands, resulting in local arbitrary command execution under the gateway service user. Exploitation requires attacker control over `config.env.vars` and the ability to trigger service install or reinstall and restart.

An attacker with local access who can influence environment variables in OpenClaw's configuration can inject arbitrary systemd directives into the user service unit file. This leads to local command execution with the privileges of the OpenClaw gateway service user upon service restart. The vulnerability does not require elevated privileges to exploit but does require the ability to modify configuration and trigger service reinstall and restart. There is no indication of remote exploitation or privilege escalation beyond the gateway service user.

A patch is available for this vulnerability. Users should upgrade OpenClaw CLI to version 2026.7.1 or later where the issue is fixed. Until patched, avoid allowing untrusted input in environment variables used in systemd unit generation and avoid triggering service reinstall or restart with such inputs. Follow vendor guidance for applying the fix.