CVE-2026-42427: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-42427 is a remote code execution (RCE) vulnerability in OpenClaw, a Node.js-based local AI assistant, caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. All versions of the npm package openclaw prior to 2026.4.8 are affected. The vulnerability was published on April 28, 2026, and a patch was released on April 8, 2026 (version 2026.4.8). It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs) and CWE-78 (OS Command Injection). OpenClaw maintains an environment variable denylist to prevent hostile variables from influencing host exec commands; however, the denylist was missing entries for HGRCPATH (Mercurial config path), CARGO_BUILD_RUSTC_WRAPPER and RUSTC_WRAPPER (Rust/Cargo build tool wrappers), and MAKEFLAGS (Make build flags). A local attacker with low privileges can set these environment variables to point to or inject malicious executables or configuration files, which are then honored by the respective build tools when OpenClaw spawns child processes, resulting in arbitrary code execution. The vulnerability is scoped to OpenClaw's local user-controlled trust model and does not assume a multi-tenant service boundary (GitHub Advisory).

A successful exploit allows a low-privileged local attacker to execute arbitrary commands with the privileges of the OpenClaw process, potentially leading to full system compromise. The primary impact is high integrity loss (arbitrary code/command execution), with limited confidentiality exposure. Availability is not directly impacted per the CVSS scoring. Because OpenClaw runs as a local assistant, exploitation is constrained to the local system, but could enable privilege escalation or lateral movement if the process runs with elevated rights (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication (Feedly). The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, and the attack complexity is rated High, further limiting practical exploitability. The vulnerability was responsibly reported by @boy-hack of Tencent Zhuque Lab (GitHub Advisory).

1. Reconnaissance: Identify a system running a vulnerable version of OpenClaw (npm package openclaw < 2026.4.8) with local access as a low-privileged user.
2. Identify target environment variables: Determine which build tools (Mercurial, Cargo/Rust, Make) are invoked by OpenClaw's exec commands and which environment variables (HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, MAKEFLAGS) are not blocked by the denylist.
3. Set malicious environment variable: Before triggering an OpenClaw operation that spawns a build tool subprocess, set one of the unblocked variables to point to a malicious payload. For example, set RUSTC_WRAPPER=/path/to/malicious_script or HGRCPATH=/path/to/malicious_hgrc containing a hook that executes attacker-controlled commands.
4. Trigger OpenClaw execution: Initiate an OpenClaw action that causes it to invoke the affected build tool (e.g., a Cargo build, Make invocation, or Mercurial operation) as a child process.
5. Achieve code execution: The build tool reads the attacker-controlled environment variable and executes the malicious wrapper or configuration hook, running arbitrary commands with the privileges of the OpenClaw process (GitHub Advisory).

• Process: Unexpected child processes spawned by the OpenClaw Node.js process, particularly hg, cargo, rustc, or make with unusual arguments or parent-child relationships; wrapper scripts or binaries referenced by RUSTC_WRAPPER, CARGO_BUILD_RUSTC_WRAPPER, or MAKEFLAGS that are not part of the standard toolchain.
• File System: Presence of unexpected or modified .hgrc files referenced by HGRCPATH; unusual scripts or binaries in locations pointed to by RUSTC_WRAPPER or CARGO_BUILD_RUSTC_WRAPPER; new or modified files created by the OpenClaw process outside expected directories.
• Logs: System or application logs showing OpenClaw spawning build tool processes with unusual environment variables set; audit logs (e.g., auditd) recording execve calls from the OpenClaw process to unexpected binaries.
• Network: Unexpected outbound connections from the OpenClaw process or its child processes to external hosts, which may indicate post-exploitation activity such as reverse shells or data exfiltration (GitHub Advisory).

Upgrade the openclaw npm package to version 2026.4.8 or later, which adds the missing denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. The verified fix is available at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. As interim workarounds, restrict local access to systems running vulnerable versions, apply the principle of least privilege to accounts running OpenClaw, and monitor or restrict environment variable modifications from untrusted sources (GitHub Advisory, GitHub Commit).

The vulnerability was reported by @boy-hack of Tencent Zhuque Lab (AI-Infra-Guard project) and credited in the official GitHub Security Advisory. The advisory notes it belongs to the same class as GHSA-cm8v-2vh9-cxf3, suggesting a pattern of similar build-tool environment variable injection issues. Community coverage has been limited to automated CVE tracking feeds and security aggregators, with no significant independent researcher commentary or media coverage identified (GitHub Advisory).