CVE-2026-41332
CVE-2026-41332 · OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials.
CVSS 5.8 · Media · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node