PT-2026-35797 · Openclaw · Openclaw

Boyhack · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41915

NVD

CVSS v3.1

5.3

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT DIR and related variables to redirect git operations and compromise repository integrity.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-41915

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cm8v-2vh9-cxf3 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41915 · Security Note
• https://twitter.com/CVEnew/status/2049227505874186301 · Twitter Post
• https://vulncheck.com/advisories/openclaw-git-environment-variable-injection-via-unfiltered-exec-environment · Note