CVE-2026-41294
OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File
Résumé
OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment settings during OpenClaw startup.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com