Shell-wrapper Detection Bypass in OpenClaw Products by OpenClaw

CVE-2026-42435

What is CVE-2026-42435?

OpenClaw versions from 2026.2.22 to 2026.4.11 are susceptible to a shell-wrapper detection bypass vulnerability. This flaw allows attackers to inject environment variable assignments at the argv level, effectively circumventing exec preflight handling and enabling manipulation of crucial shell variables such as SHELLOPTS and PS4. Such manipulations can severely compromise the execution semantics and security mechanisms in place, resulting in potential exploitation risks.

References