CVE-2026-22217: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-22217 is an arbitrary code execution vulnerability in the shell-env component of OpenClaw, an npm package. It affects versions >= 2026.2.22 and <= 2026.2.22-2, and was patched in version 2026.2.23. The flaw allows a local attacker with low privileges to execute attacker-controlled binaries by manipulating the $SHELL environment variable in conjunction with writable trusted-prefix directories (e.g., /opt/homebrew/bin). It was disclosed on March 18, 2026, with a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-184 (Incomplete List of Disallowed Inputs). In vulnerable versions, OpenClaw's shell-env module accepted a shell binary either if it was listed in /etc/shells or if it resided under one of several hardcoded trusted prefixes (/bin/, /usr/bin/, /usr/local/bin/, /opt/homebrew/bin/, /run/current-system/sw/bin/) and was executable. The selected shell was then invoked as a login shell (-l -c 'env -0') to probe the runtime environment. On systems where a trusted-prefix directory is writable — a common scenario in Homebrew-managed macOS environments under /opt/homebrew/bin — an attacker who can influence the $SHELL environment variable can place a malicious binary at that path and have it executed within the OpenClaw process context. The fix removes the trusted-prefix fallback entirely, now trusting only shells explicitly registered in /etc/shells, falling back to /bin/sh otherwise (GitHub Advisory, Fix Commit).

A successful exploit allows a local, low-privileged attacker to execute arbitrary binaries within the OpenClaw process context, resulting in high integrity impact and low availability impact with no direct confidentiality impact per the CVSS scoring. The attack requires specific preconditions — a writable trusted-prefix directory and the ability to influence $SHELL — but once met, the attacker gains code execution at the privilege level of the OpenClaw process. This could be leveraged for privilege escalation, persistence, or further lateral movement depending on the process's permissions (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and the specific environmental condition of a writable trusted-prefix directory, which limits the attack surface (Feedly, GitHub Advisory).

1. Reconnaissance: Identify a target system running OpenClaw npm package version >= 2026.2.22 and <= 2026.2.22-2 with a writable trusted-prefix directory such as /opt/homebrew/bin (common on macOS with Homebrew).
2. Verify write access: Confirm that the attacker's low-privileged account has write permissions to a directory in the trusted-prefix list (e.g., /opt/homebrew/bin).
3. Craft malicious binary: Create a malicious executable (e.g., a shell script or compiled binary) that performs the desired action (reverse shell, data exfiltration, persistence mechanism) and place it in the writable trusted-prefix directory with a plausible shell name (e.g., /opt/homebrew/bin/zsh).
4. Manipulate $SHELL: Set the $SHELL environment variable to point to the malicious binary (e.g., export SHELL=/opt/homebrew/bin/evil-shell) in the runtime environment where OpenClaw will be invoked.
5. Trigger OpenClaw execution: Cause OpenClaw to run in the manipulated environment. The shell-env module will evaluate $SHELL, find it under a trusted prefix, verify it is executable, and invoke it as -l -c 'env -0'.
6. Achieve code execution: The malicious binary executes within the OpenClaw process context, granting the attacker arbitrary code execution at the process's privilege level (GitHub Advisory, Fix Commit).

• File System: Unexpected or newly created executables in trusted-prefix directories such as /opt/homebrew/bin/, /usr/local/bin/, or /run/current-system/sw/bin/ that are not legitimate shell binaries; file modification timestamps on binaries in these directories that do not align with package manager activity.
• Process: Unusual child processes spawned by the OpenClaw Node.js process (e.g., unexpected shell invocations, network tools like curl, wget, or nc); processes with parent PID matching the OpenClaw process executing binaries not registered in /etc/shells.
• Logs: System or application logs showing OpenClaw invoking a shell binary from /opt/homebrew/bin/ or other trusted-prefix paths that is not listed in /etc/shells; audit logs (e.g., auditd on Linux) recording execution of unexpected binaries by the OpenClaw process user.
• Environment: The $SHELL environment variable set to a path under a trusted prefix that does not correspond to a legitimate, registered shell in /etc/shells (GitHub Advisory).

Upgrade OpenClaw to version 2026.2.23 or later, which removes the trusted-prefix fallback and restricts shell selection exclusively to binaries registered in /etc/shells. As an interim workaround, ensure that all trusted-prefix directories (/opt/homebrew/bin, /usr/local/bin, etc.) have strict filesystem permissions preventing unauthorized writes. Additionally, restrict local user access to systems running OpenClaw and audit the $SHELL environment variable for unexpected values. Monitoring /etc/shells for unauthorized modifications is also recommended (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher @tdjackey and disclosed by maintainer steipete via a GitHub Security Advisory on February 24, 2026. RedPacket Security flagged the CVE in automated alerts. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory, RedPacket Security).