Openclaw cli: OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

The vulnerability in OpenClaw CLI's system.run function involves insufficient sanitization of environment variable overrides. Specifically, dangerous override-only environment variables such as GIT_SSH_COMMAND and prefix families like GIT_CONFIG_* and NPM_CONFIG_* were not blocked, allowing attackers who can invoke system.run with env overrides to bypass allowlist or approval intent. This leads to subprocesses inheriting attacker-controlled environment variables that alter helper-command execution or configuration loading, diverging from the reviewed binary and arguments. The fix, released in version 2026.3.7, extends the sanitization to block these dangerous keys and prefixes while preserving trusted base environment behavior.

An attacker with permission to invoke system.run and supply environment overrides can bypass allowlist and approval controls by steering allowlisted tools through environment variables that affect helper-command execution or configuration loading. This results in subprocess behavior that is not represented by the approved command line, potentially leading to unintended command execution or configuration manipulation. The severity is rated medium because exploitation requires existing execution capability.

A patch is available in OpenClaw CLI version 2026.3.7 that addresses this vulnerability by extending environment override sanitization to block dangerous override-only keys and prefixes. Users should upgrade to version 2026.3.7 or later to remediate this issue.