| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.22 | 2026.3.22 |
| openclaw | < 2026.3.22 | 2026.3.22 |
Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior.
An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.
src/infra/host-env-security-policy.json, src/infra/host-env-security.ts
< 2026.3.22>= 2026.3.22Fixed by commit 7abfff756d (Exec: harden host env override handling across gateway and node).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free