OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)

MEDIO 6.1CVE-2026-41915 · GHSA-cm8v-2vh9-cxf3 · Published 28/04/2026 · updated 17/06/2026

In breve

CVE-2026-41915 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda openclaw (openclaw), openclaw.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.11%, superiore al 1.5% delle vulnerabilità.
Correzione: aggiornare a 2026.4.8 o successiva.

Package	Affected versions	Patched versions
openclaw openclaw	`< 2026.4.8`	`2026.4.8`
openclaw npm	`< 2026.4.8`	`2026.4.8`

Description

Impact

GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant).

Git plumbing environment variables were not removed before host exec and could redirect Git operations.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <=2026.3.30
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @boy-hack of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

NVD description

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity.

References

openclaw/openclaw security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-41915 · ADVISORY
openclaw/openclaw commit d7c3210 · WEB
openclaw/openclaw · PACKAGE
vulncheck.com/advisories/openclaw-git-environment-variable-injection-via-unfiltered-exec-environment · WEB

Altre vulnerabilità di openclaw

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openclaw

< 2026.4.8

2026.4.8

openclaw

npm

< 2026.4.8

2026.4.8

Description

Impact

GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant).

Git plumbing environment variables were not removed before host exec and could redirect Git operations.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <=2026.3.30
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @boy-hack of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.

NVD description

Altre vulnerabilità di openclaw

Vedi tutto →