CVE-2026-41387
OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.
Ver en NVDAnálisis
OpenClaw is a specialized host security tool for environment sanitization that is not widely used in the common development stack. The vulnerability allows attackers to redirect package resolution to malicious infrastructure, but the impact is limited to environments already running this specific niche tool and requires approved exec requests to trigger.
Severidad
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCWE-183EPSS
Afecta
openclaw:openclawDescripción técnica
OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.