PT-2026-23558 · Openclaw · Openclaw

Mrthankyou · Publicado 2026-03-05 · Atualizado 2026-03-06 · CVE-2026-28484

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.15

Description The software contains an option injection flaw in the git-hooks/pre-commit hook. This allows attackers to stage files that are normally ignored by creating files that begin with dashes. The hook does not properly separate filenames when using xargs with git add, which enables attackers to inject git flags and add sensitive ignored files, such as .env files, to the git history.

Recommendations Update to version 2026.2.15 or later.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-28484

Produtos afetados

Openclaw

Referências · 8

• https://github.com/openclaw/openclaw/commit/ba84b1253967143692166023f9e174c149b6f2ed · Correção
• https://github.com/openclaw/openclaw/commit/b88f37762f5b6d7ec0f589eb761815e466e4ef4b · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mmpf-jwf4-h3qv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28484 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-option-injection-in-pre-commit-hook-via-malicious-filenames · Nota
• https://t.me/CVEtracker/46502 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2029689380000940385 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2029886539703218493 · Publicação no Twitter