Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2026-41391

OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting malicious index URLs through unsanitized environment variables.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.3.31affected
  • 2026.3.31unaffected
pkg:npm/openclaw

References