CVE-2026-43531

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise...

CVE-2026-43531

OpenClaw is vulnerable prior to version 2026.4.9 due to an environment variable injection flaw that allows malicious workspace .env files to set runtime-control variables. This can alter update sources, gateway URLs, ClawHub resolution, and browser executable paths, potentially changing applicati...

CVE-2026-43531 OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise...

CVE-2026-43531

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise...

CVE-2026-43531 OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise...

EUVD-2026-27273

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.9 contained security vulnerabilities. These vulnerabilities were caused by environmental variable injection, allowing malicious workarea.env files to set runtime control...

External Control of System or Configuration Setting

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the loading of workspace .env files. An attacker can manipulate runtime-control variables by crafting a malicious .env file that se...

GHSA-7WV4-CC7P-JHXC OpenClaw: Workspace .env could inject OpenClaw runtime-control variables

Summary Workspace .env could inject OpenClaw runtime-control variables. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.9 Impact A malicious workspace .env file could set OpenClaw runtime-control variables affecting update sources, gateway URLs,...

OpenClaw: Workspace .env could inject OpenClaw runtime-control variables

Summary Workspace .env could inject OpenClaw runtime-control variables. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.9 Impact A malicious workspace .env file could set OpenClaw runtime-control variables affecting update sources, gateway URLs,...

PT-2026-37016

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.9 Description An environment variable injection issue exists where malicious workspace .env files can set runtime-control variables. This allows attackers to inject variables that affect update sources, gatewa...

CVE-2026-32198

creationtimestamp| type| source ---|---|--- 2026-04-14 12:20:56+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0116 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 19:38:44+00:00| seen|...

CVE-2025-27448

creationtimestamp| type| source ---|---|--- 2025-07-03 06:21:23+00:00| seen| https://infosec.exchange/users/certvde/statuses/114787856061012885 2025-07-03 06:23:55+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3lt23lwyqz3d2...

CVE-2025-33067

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 19:35:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrbna2galw2a 2025-06-12 23:48:30+00:00| seen|...

CVE-2024-42410

creationtimestamp| type| source ---|---|--- 2025-02-12 22:18:41+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhz7dhq73c2a 2025-02-13 00:58:20+00:00| seen| https://infosec.exchange/users/cve/statuses/113993862343019262 2025-02-13 01:09:49+00:00| seen|...

CVE-2024-30211

creationtimestamp| type| source ---|---|--- 2025-02-12 22:16:56+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhz7adj72k2a 2025-02-12 22:43:11+00:00| seen| https://infosec.exchange/users/cve/statuses/113993330893506490 2025-08-26 13:26:33+00:00| seen|...

CVE-2025-24036

creationtimestamp| type| source ---|---|--- 2025-02-11 18:08:38+00:00| seen| https://www.thezdi.com/blog/2025/2/11/the-february-2025-security-update-review 2025-02-11 18:18:45+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwbhj2sd62a 2025-02-11 21:19:27+00:00| seen|...

CVE-2025-21212

creationtimestamp| type| source ---|---|--- 2025-02-11 18:08:38+00:00| seen| https://www.thezdi.com/blog/2025/2/11/the-february-2025-security-update-review 2025-02-11 18:17:00+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwbef65e62a 2025-02-11 18:49:17+00:00| seen|...

CVE-2024-55948

creationtimestamp| type| source ---|---|--- 2025-02-04 21:11:19+00:00| seen| https://infosec.exchange/users/cve/statuses/113947671170575758 2025-02-04 21:16:03+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhey44ijbq27 2025-02-04 22:23:43+00:00| seen|...

CVE-2025-24631

creationtimestamp| type| source ---|---|--- 2025-02-03 15:18:35+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhbtnyligy27 2025-02-03 17:48:53+00:00| seen| https://t.me/cvedetector/17072 2025-02-03 17:55:44+00:00| seen|...