PT-2026-32073 · Npm · Openclaw

Published 2026-03-31 · Updated 2026-03-31

OSV

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior.

Impact

An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.

Affected Component

src/infra/host-env-security-policy.json, src/infra/host-env-security.ts

Fixed Versions

• Affected: < 2026.3.22
• Patched: >= 2026.3.22

Fix

Fixed by commit 7abfff756d (Exec: harden host env override handling across gateway and node).

Fix

Weakness Enumeration

CWE-183

Related Identifiers

GHSA-J7P2-QCWM-94V4

Affected Products

Openclaw

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-41387 · Security Note
• https://osv.dev/vulnerability/GHSA-j7p2-qcwm-94v4 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4 · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.22 · Note
• https://github.com/openclaw/openclaw/commit/7abfff756d6c68d17e21d1657bbacbaec86de232 · Note
• https://vulncheck.com/advisories/openclaw-supply-chain-redirection-via-incomplete-host-environment-sanitization · Note