CVE-2026-41387
CVE-2026-41387 · OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.
CVSS 8.5 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node