Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2026-41332

OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.3.28affected
  • 2026.3.28unaffected
pkg:npm/openclaw

References