OpenClaw versions before 2026.3.24 contain a critical environment variable injection vulnerability in the CLI backend runner. Attackers can exploit this flaw by crafting malicious workspace configuration files to inject arbitrary environment variables into the backend process. This vulnerability enables code execution and sensitive data exposure through the workspace configuration mechanism. The vulnerability affects the CLI backend runner component specifically and has been addressed in version 2026.3.24.