OpenClaw versions from 2026.2.22 up to but not including 2026.4.12 contain a vulnerability where shell-wrapper detection missed environment-argv assignment injection forms. This flaw could affect execution semantics by allowing high-risk shell environment variables to be manipulated. The issue was fixed in version 2026.4.12 and later.