EUVD-2026-25315
GHSA-wcm7-94wg-h74h
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privileges required for approved exec access; high complexity due to multi-condition prerequisites; integrity high from git hook code execution, confidentiality low from AWS credential redirection only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.28.
DescriptionCVE.org
OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials.
AnalysisAI
Environment variable injection in OpenClaw (npm) versions through 2026.3.24 allows a local, low-privileged attacker who can submit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files, enabling untrusted code execution via git template hooks or malicious AWS credential loading. The root cause is an incomplete host-env blocklist - specifically, GIT_TEMPLATE_DIR and AWS_CONFIG_FILE were absent from the sanitization policy in src/infra/host-env-security-policy.json and src/infra/host-env-security.ts. No public exploit has been identified at time of analysis; EPSS sits at the 3rd percentile and SSVC rates exploitation as none, indicating no known active threat activity.
Technical ContextAI
OpenClaw is an npm-distributed platform that executes host commands ('exec requests') on behalf of authorized callers. To prevent environment variable hijacking, it maintains a host-env blocklist (CWE-184: Incomplete List of Disallowed Inputs) implemented in src/infra/host-env-security-policy.json and src/infra/host-env-security.ts. The blocklist failed to include GIT_TEMPLATE_DIR, which git uses to load template files (including hooks that execute arbitrary scripts on operations like clone or init), and AWS_CONFIG_FILE, which the AWS CLI uses to locate its configuration, potentially redirecting credential sources or endpoint overrides. Both variables are well-known environment-based injection vectors that allow trusted, signed binaries to execute untrusted content - a supply-chain-adjacent technique. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covering all versions up to and including 2026.3.24.
RemediationAI
The primary fix is to upgrade the OpenClaw npm package to version 2026.3.28 or later, which is confirmed as the patched release per the vendor's GitHub Security Advisory (GHSA-m866-6qv5-p2fg) and commit 6eb82fba3cbfd0e50b179c1fada92e1e22dce7fa (commit message: 'Infra: block additional host exec env keys'). If an immediate upgrade is not possible, a targeted compensating control is to audit and strip GIT_TEMPLATE_DIR and AWS_CONFIG_FILE from any environment passed to OpenClaw exec request handlers at the process or container level using a wrapper script or process supervisor environment filter - this prevents the untrusted values from reaching git or AWS CLI invocations but may break legitimate use of custom AWS configuration files and should be tested for side effects. Additionally, restricting which principals can submit approved exec requests to only trusted, audited callers reduces the attacker's ability to reach the vulnerable code path. No patch version other than 2026.3.28 should be assumed safe; the fix version is independently confirmed by both the GHSA advisory and the EUVD entry.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today