CVE-2026-100570

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...