CVE-2026-41294
CVE-2026-41294 · OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment settings during OpenClaw startup.
CVSS 8.5 · Alta · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node