CVE-2026-28684 python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

Linux Distros Unpatched Vulnerability : CVE-2026-28684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv...

PT-2026-33800

Name of the Vulnerable Software and Affected Versions python-dotenv versions prior to 1.2.2 Description The set key and unset key functions in python-dotenv follow symbolic links when rewriting .env files. This occurs when the rewrite context manager in dotenv/main.py writes to a temporary file i...

python-dotenv 安全漏洞

python-dotenv is a Python environment management tool developed by Saurabh Kumar. Versions of python-dotenv prior to version 1.2.2 contained security vulnerabilities. These vulnerabilities stemmed from defects in the setkey and unsetkey functions when dealing with symbolic links, which could allo...

MAL-2026-2900 Malicious code in dotenv-pack (npm)

dotenv-pack is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint.io/5b357f718ab4ee355003 and executes it similar to malware in to chai-await-test. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

Malicious code in dotenv-pack (npm)

dotenv-pack is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint.io/5b357f718ab4ee355003 and executes it similar to malware in to chai-await-test. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

CVE-2026-39394 CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings, which...

CI4MS 访问控制错误漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.4.0 contained a access control vulnerability. This vulnerability stemmed from the reliance on volatile cache checks for routing protection, which could lead to ineffective protection when the...

External Control of System or Configuration Setting

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the handling of the .env file, which can override the trusted root directory for bundled plugins. An attacker can influence the...

External Control of System or Configuration Setting

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the handling of the .env configuration file, which allows the override of the OPENCLAWBUNDLEDHOOKSDIR environment variable. An...

Untrusted Search Path

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Untrusted Search Path via the loading of .env files from the current working directory before trusted configuration is applied. An attacker can override runtime configuration and...

GHSA-8RH7-6779-CJQQ OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...

Malicious Package

Overview @universeorg/dotenv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @universeorg/dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e1bca28be318e644a718c57c724dac6b6b480889b772e317cda8bb23512515c The package @universeorg/dotenv was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2220 Malicious code in @universeorg/dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e1bca28be318e644a718c57c724dac6b6b480889b772e317cda8bb23512515c The package @universeorg/dotenv was found to contain malicious code. Source: ghsa-malware...

Malicious code in dotenv-xtend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6523f1fff137b4db7fd0ed316a5d88d808ecb32bf0456c9977cdae82564f15d The package dotenv-xtend was found to contain malicious code...

MAL-2026-2351 Malicious code in dotenv-xtend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6523f1fff137b4db7fd0ed316a5d88d808ecb32bf0456c9977cdae82564f15d The package dotenv-xtend was found to contain malicious code...

MAL-2026-2350 Malicious code in dotenv-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87c063897212774df4e13b1d7bf70cc74a98ac1ca824d2bb1f1e8c60d0662b5e Package impersonates the popular dotenv package: package.json points its repository field to git://github.com/motdotla/dotenv.git and homepage to...

Malicious code in dotenv-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87c063897212774df4e13b1d7bf70cc74a98ac1ca824d2bb1f1e8c60d0662b5e Package impersonates the popular dotenv package: package.json points its repository field to git://github.com/motdotla/dotenv.git and homepage to...