Skip to content

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

Critical severity GitHub Reviewed Published Mar 29, 2026 in openclaw/openclaw

Package

npm openclaw (npm)

Affected versions

< 2026.3.22

Patched versions

2026.3.22

Description

Summary

Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior.

Impact

An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.

Affected Component

src/infra/host-env-security-policy.json, src/infra/host-env-security.ts

Fixed Versions

  • Affected: < 2026.3.22
  • Patched: >= 2026.3.22

Fix

Fixed by commit 7abfff756d (Exec: harden host env override handling across gateway and node).

References

@steipete steipete published to openclaw/openclaw Mar 29, 2026
Published to the GitHub Advisory Database Mar 31, 2026
Reviewed Mar 31, 2026

Severity

Critical

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS score

Weaknesses

Permissive List of Allowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-j7p2-qcwm-94v4

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.