CVE-2026-41387
OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.
View on NVDAnalysis
OpenClaw is a specialized host security tool for environment sanitization that is not widely used in the common development stack. The vulnerability allows attackers to redirect package resolution to malicious infrastructure, but the impact is limited to environments already running this specific niche tool and requires approved exec requests to trigger.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCWE-183EPSS
Affects
openclaw:openclawTechnical description
OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.