CVE-2026-101884 in Windows
Summary
by MITRE • 09/30/2026
OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in OpenClaw Windows Node versions prior to 2026.7.1 represents a critical failure in input sanitization within the system.run command execution module. This flaw stems from an incomplete environment variable sanitizer that fails to filter or restrict specific, high-risk environment variables such as GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS. These particular variables are known vectors for code injection because they allow external configuration files or scripts to be loaded automatically by their respective runtime environments without explicit user interaction during the execution of standard binaries like git, dotnet, or java. The absence of proper validation allows an attacker who has gained access through a gateway or agent interface to manipulate these environment variables before invoking allowed tools, thereby bypassing security controls that rely on command-line argument filtering alone.
From a technical perspective, this vulnerability exploits the inherent behavior of modern development and runtime environments which prioritize configuration flexibility over strict isolation by default. When an attacker supplies values for GIT_CONFIG_GLOBAL or similar git-related variables, they can point to malicious configuration files containing hooks or remote repositories that execute arbitrary commands upon invocation. Similarly, setting DOTNET_STARTUP_HOOKS allows an attacker to load a compiled DLL into the .NET runtime process space before any application logic runs, effectively hijacking the execution flow of any dotnet command executed by the system. The JAVA_TOOL_OPTIONS variable is equally dangerous as it permits the injection of Java agent code or JVM arguments that can alter class loading mechanisms or execute native libraries, leading to full compromise of the underlying operating system context in which the OpenClaw node operates.
The operational impact of this vulnerability is severe, enabling arbitrary code execution with the privileges of the user account running the OpenClaw service. Since these environment variables are processed by the target binaries themselves rather than being passed as direct arguments to a vulnerable function, traditional command-line sanitization techniques are ineffective. An attacker leveraging gateway or agent access can craft requests that set these variables in the process environment prior to execution, resulting in remote code execution without requiring additional exploits against the underlying operating system kernel or application logic. This capability allows for lateral movement within the network, data exfiltration, and persistent backdoor installation depending on the permissions granted to the OpenClaw service account.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, specifically regarding environment variable injection, and maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via Environment Variable Hijacking. It also relates to CWE-643 Improper Mitigation for Preprocessing Errors where input validation is incomplete. To mitigate this risk, organizations must upgrade OpenClaw Windows Node to version 2026.7.1 or later which addresses the sanitization logic in system.run. In the interim, administrators should restrict environment variable propagation by configuring group policies or service accounts to clear these specific variables before execution. Additionally, implementing strict allowlists for allowed commands and monitoring for unusual process creation events involving git, dotnet, or java with unexpected environment contexts can help detect exploitation attempts.