Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary code execution.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42427 Remote Code Execution in OpenClaw Before 2026.4.8 via Environment Variable Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42427
Post summary
The text discloses CVE‑2026‑42427, a remote code execution vulnerability in OpenClaw prior to version 2026.4.8, caused by environment variable injection, with no additional details on PoC, exploit code, active attacks, or patches.
CVE-2026-42427 OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPE… https://www.cve.org/CVERecord?id=CVE-2026-42427
Post summary
The post reports the discovery of CVE-2026-42427, describing it as an RCE flaw in OpenClaw due to missing environment‑variable denylist entries. No PoC, exploit code, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |