Environment Variable Sanitization Vulnerability in OpenClaw by OpenClaw

CVE-2026-41332

What is CVE-2026-41332?

OpenClaw versions prior to 2026.3.28 are vulnerable to an environment variable sanitization flaw. This issue arises because essential environment variables such as GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not included in the host-env blocklist. Malicious actors can exploit this flaw through approved executable requests, enabling them to alter the behavior of git or the AWS CLI. This leads to the potential execution of untrusted code or loading of harmful credentials from attacker-controlled configuration files.

References