~ / search / GHSA-j7p2-qcwm-94v4

GHSA-j7p2-qcwm-94v4

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

Source: GitHub Advisory Database (reviewed) High CVE-2026-41387

Packages

EcosystemPackageAffectedFixed in
npm openclaw < 2026.3.22 2026.3.22

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior. ## Impact An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content. ## Affected Component `src/infra/host-env-security-policy.json, src/infra/host-env-security.ts` ## Fixed Versions - Affected: `< 2026.3.22` - Patched: `>= 2026.3.22` ## Fix Fixed by commit `7abfff756d` (`Exec: harden host env override handling across gateway and node`).

References

External links from the advisory. They lead to third-party sites.