Openclaw cli: OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant) (CVE-2026-41915)

The OpenClaw CLI had a security issue (CVE-2026-41915) where Git plumbing environment variables, including GIT_DIR, were missing from the execution environment denylist. This allowed these variables to persist in the environment during host exec calls, potentially redirecting Git operations. The vulnerability affects versions of the openclaw package from 2026.1.29 up to but not including 2026.4.8. The fix was committed and released in version 2026.4.8, with targeted regression tests confirming the resolution.

The vulnerability could allow an attacker with local user privileges to influence Git operations by redirecting them through environment variables that were not properly sanitized. This could lead to unauthorized modification or interference with Git repositories accessed by OpenClaw. The CVSS score is 5.3 (medium severity), indicating limited but notable impact with low attack vector (local), high attack complexity, and low privileges required.

A patch is available and should be applied by upgrading to openclaw version 2026.4.8 or later. The fix removes Git plumbing environment variables from the execution environment denylist, preventing redirection of Git operations. No additional mitigation steps are indicated by the vendor advisory.