Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-32056

31
FAUCET Score

CVE-2026-32056 affects OpenClaw versions prior to 2026.2.22, stemming from a failure to sanitize HOME and ZDOTDIR environment variables within the system.run function. This critical vulnerability (CVSS 9.8) allows unauthenticated remote attackers to bypass command allowlist protections by injecting malicious shell startup files, leading to arbitrary code execution. The attack requires low complexity and no user interaction, posing a significant risk to affected systems. While not currently listed on CISA's KEV catalog and lacking public exploit code, the vulnerability has garnered some community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0, < 2026.2.22CPE match
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
< 2026.2.22CPE matchmatch criteria
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 4.0

7.7HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.56%
Probability of exploitation in next 30 days
EPSS Percentile
43.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0056 is in the 23rd percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: openclawFixed in: 2026.2.22

Vendor Advisories (1)

npmGHSA-xgf2-vxv2-rrmghigh

OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

Mar 3, 2026

References

github.com / openclaw/openclaw/commit/c2c7114ed39a547ab6276e1e933029b9530ee906
Patch
github.com / openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg
Vendor Advisory
vulncheck.com / advisories/openclaw-remote-code-execution-via-shell-startup-environment-variable-injection-in-system-run
Third Party Advisory