CVE-2026-41332
OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist
Résumé
OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com