CVE-2026-22217

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by exploiting trusted-prefix fallback logic for the $SHELL variable. An attacker can influence the $SHELL environment variable on systems with writable trusted-prefix directories such as /opt/homebrew/bin to execute arbitrary binaries in the OpenClaw process context.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
OpenClaw	OpenClaw	>= 2026.2.22, < 2026.2.23

References

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-222186.5Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client c CVE-2026-222197.7Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configu CVE-2026-22224.8A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2026-222204.5A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to caus CVE-2026-222218.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker e CVE-2026-222228.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attac CVE-2026-222238.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker CVE-2026-222247.2A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Arch CVE-2026-222257.2A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 CVE-2026-222267.2A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer CVE-2026-222277.2A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the CVE-2026-222284.9An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted con