| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.
A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.
src/infra/dotenv.ts, src/cli/dotenv.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 6a79324802 (Filter untrusted CWD .env entries before OpenClaw startup).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free