CVE-2026-101884

Summary

The flaw is an incomplete environment variable sanitizer in OpenClaw Windows Node that fails to block critical variables like GIT_CONFIG_* and DOTNET_STARTUP_HOOKS, allowing attackers with gateway or agent access to inject malicious code into allowed tools like git, dotnet, and java, leading to arbitrary code execution.

Exploitability

Exploitation requires gateway or agent access and is moderately difficult due to the need to craft environment variables that bypass the sanitizer, but once achieved, allows full code execution through the allowed tools.

Blast radius

If exploited, attackers could execute arbitrary code on systems running OpenClaw Windows Node versions prior to 2026.7.1, potentially leading to complete system compromise and lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenClaw Windows Node version 2026.7.1 or later to fix the environment variable sanitization issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.