Is there a patch available for CVE-2026-41915?

Yes, a patch is available for CVE-2026-41915. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41915

Q: What is the CVSS score of CVE-2026-41915?

CVE-2026-41915 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26121 MEDIUM

Incomplete List of Disallowed Inputs (CWE-184)

2026-04-28 VulnCheck

Information Disclosure Openclaw

5.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local-only vector with low privilege and high complexity required to pre-seed GIT_DIR; integrity impact is high but no availability or scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:19 vuln.today

Analysis Generated

Jul 24, 2026 - 04:19 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.3 (MEDIUM) 5.8 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26121

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:10 nvd

MEDIUM 5.8

DescriptionCVE.org

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity.

AnalysisAI

Git environment variable injection in OpenClaw (npm) before 2026.4.8 allows a local low-privileged attacker to redirect git operations by setting GIT_DIR and related plumbing variables in the process environment prior to host exec calls. The root cause is an incomplete denylist (CWE-184) that strips some but not all dangerous environment variables before shelling out. No public exploit or active exploitation has been identified at time of analysis; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' corroborate low near-term exploitation likelihood.

Technical ContextAI

OpenClaw is a user-controlled local AI assistant distributed as an npm package (cpe:2.3:a:openclaw:openclaw). When the assistant performs host exec operations - spawning subprocesses that invoke git - it sanitizes the inherited environment via a denylist. CWE-184 (Incomplete List of Disallowed Inputs) captures the flaw: the denylist omitted GIT_DIR and related git plumbing variables such as GIT_WORK_TREE and GIT_INDEX_FILE. Because these variables are inherited verbatim by child processes, an attacker who can influence the parent environment can redirect any git operation to an arbitrary directory they control, overriding the repository the tool intends to operate on. The GHSA advisory notes this is a variant of the known GHSA-m866-6qv5-p2fg pattern, indicating a recurring class of env-sanitization failures in AI coding assistant tooling.

RemediationAI

Upgrade the openclaw npm package to version 2026.4.8 or later using 'npm install openclaw@2026.4.8' or 'npm update openclaw'. The fix is pinned to commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on the main branch, as confirmed by the GHSA advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-cm8v-2vh9-cxf3. If immediate upgrade is not feasible, a compensating control is to run OpenClaw in a process with a minimal, explicitly constructed environment (e.g., via env -i in a wrapper script) that excludes GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, GIT_OBJECT_DIRECTORY, and GIT_ALTERNATE_OBJECT_DIRECTORIES before launching the tool; this prevents variable inheritance but may break legitimate proxy or toolchain configuration if other environment variables are also stripped.