PT-2026-32299 · Npm · Openclaw

Published 2026-04-03 · Updated 2026-04-03

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

Current Maintainer Triage

• Normalized severity: medium
• Assessment: v2026.3.28 also misses the broader package, registry, compiler, Docker, and TLS env family in the shipped host-env policy, and the unreleased main fix means this is a real medium-severity open issue.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• eb8de6715f02949c21c4e895fffc8a6dcb00975c — 2026-03-31T19:37:43+09:00

OpenClaw thanks @tdjackey for reporting.

Fix

Exposure of Resource to Wrong Sphere

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-668

CWE-184

Related Identifiers

GHSA-CG7Q-FG22-4G98

Affected Products

Openclaw

References · 6

• https://osv.dev/vulnerability/GHSA-cg7q-fg22-4g98 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cg7q-fg22-4g98 · Note
• https://github.com/openclaw/openclaw/commit/eb8de6715f02949c21c4e895fffc8a6dcb00975c · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-insufficient-environment-variable-sanitization-in-host-execution · Note