PT-2026-32073 · Npm · Openclaw

Publicado 2026-03-31 · Atualizado 2026-03-31

OSV

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior.

Impact

An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.

Affected Component

src/infra/host-env-security-policy.json, src/infra/host-env-security.ts

Fixed Versions

• Affected: < 2026.3.22
• Patched: >= 2026.3.22

Fix

Fixed by commit 7abfff756d (Exec: harden host env override handling across gateway and node).

Correção

Enumeração de Fraquezas

CWE-183

Identificadores relacionados

GHSA-J7P2-QCWM-94V4

Produtos afetados

Openclaw

Referências · 7

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4 · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.22 · Nota
• https://github.com/openclaw/openclaw/commit/7abfff756d6c68d17e21d1657bbacbaec86de232 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-41387 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j7p2-qcwm-94v4 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-supply-chain-redirection-via-incomplete-host-environment-sanitization · Nota