PT-2026-32066 · Npm · Openclaw

Publicado 2026-04-01 · Atualizado 2026-04-01

OSV

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.

Impact

A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.

Affected Component

src/infra/dotenv.ts, src/cli/dotenv.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 6a79324802 (Filter untrusted CWD .env entries before OpenClaw startup).

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

GHSA-8RH7-6779-CJQQ

Produtos afetados

Openclaw

Referências · 5

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8rh7-6779-cjqq · Nota
• https://github.com/openclaw/openclaw/commit/6a793248024dca7685f63bcceb64a0096fd1586d · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Nota
• https://osv.dev/vulnerability/GHSA-8rh7-6779-cjqq · Aviso do Fabricante