{"id":"CVE-2026-32063","aliases":["GHSA-vffc-f7r7-rx2w"],"url":"https://o3.security/vulnerability/CVE-2026-32063","summary":"OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation","details":"### Summary\nA command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path.\nWhen rendering `Environment=` entries, attacker-controlled values are not rejected for CR/LF, and `systemdEscapeArg()` uses an incorrect whitespace-matching regex. This allows newline injection to break out of an `Environment=` line and inject standalone systemd directives (for example, `ExecStartPre=`). On service restart, the injected command is executed, resulting in local arbitrary command execution (local RCE) under the gateway service user.\n\n---\n\n### Details\nThe issue is in `src/daemon/systemd-unit.ts`:\n\n- `renderEnvLines(...)` builds:\n- `Environment=${systemdEscapeArg(`${key}=${value}`)}`\n- No CR/LF validation is enforced for environment keys/values before writing unit lines.\n- `systemdEscapeArg(...)` uses:\n- `/[\\\\s\"\\\\\\\\]/`\n- In this regex, `\\\\s` is interpreted as a literal backslash + `s`, not a whitespace character class.\nAs a result, whitespace detection/quoting behavior is incorrect.\nBecause systemd parses unit files line-by-line, a newline inside an environment value can inject an additional directive line. Example rendered output:\n\n```ini\nEnvironment=INJECT=ok\nExecStartPre=/bin/touch /tmp/oc15789_rce\n```\n\nAt restart time, systemd executes `ExecStartPre`, enabling command execution.\n\nRelevant code path/components involved in exploitation chain:\n- `src/daemon/systemd-unit.ts`\n- `src/commands/daemon-install-helpers.ts`\n- `src/config/env-vars.ts`\n- `src/config/zod-schema.ts`\n\nTrigger conditions:\n1. Attacker can influence `config.env.vars` (directly or indirectly).\n2. Install/reinstall path is invoked to write/update the unit.\n3. Service restart occurs (`systemctl --user restart ...`).\n\n---\n\n### PoC\nEnvironment: Linux host with systemd user services enabled.\n\n1. Configure a malicious environment value in OpenClaw config (`config.env.vars`), including a newline and injected directive:\n- Key: `INJECT`\n- Value:\n```text\nok\nExecStartPre=/bin/touch /tmp/oc15789_rce\n```\n\n2. Install/reinstall the gateway service (fixed port as requested):\n```bash\nopenclaw gateway install --port 15789 --force\n```\n\n3. Inspect the generated user unit file (default path):\n```bash\n~/.config/systemd/user/openclaw-gateway.service\n```\nVerify that an injected standalone line exists:\n```ini\nExecStartPre=/bin/touch /tmp/oc15789_rce\n```\n\n4. Reload and restart user service:\n```bash\nsystemctl --user daemon-reload\n```\n```bash\nsystemctl --user restart openclaw-gateway.service\n```\n\n5. Confirm command execution side effect:\n```bash\nls -l /tmp/oc15789_rce\n```\n---\n\n### Impact\nThis is a local command execution vulnerability in OpenClaw’s systemd unit generation during install/reinstall flows.\n\n- **Type:** Command injection via newline/directive injection in unit file generation.\n- **Execution context:** Runs with the same privileges as the OpenClaw gateway service user.\n- **Affected users:** Linux deployments using systemd user services where an attacker can control `config.env.vars` and trigger install/reinstall.\n\n## Fix Commit(s)\n- `61f646c41fb43cd87ed48f9125b4718a30d38e84`","published":"2026-03-11T13:32:36.727Z","modified":"2026-10-28T02:31:13.654317250Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.21"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/61f646c41fb43cd87ed48f9125b4718a30d38e84","label":"openclaw/openclaw@61f646c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32063.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vffc-f7r7-rx2w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32063"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-command-injection-via-newline-in-systemd-unit-generation"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/61f646c41fb43cd87ed48f9125b4718a30d38e84"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:13.654317250Z"}}