Threats tagged 'ghsa-8wg3-5mcm-fjq8'

A vulnerability in openclaw-cli allows a workspace .env file to override the Homebrew executable selection during skill install flows. This could cause an unintended Homebrew-compatible executable to run if the feature is enabled and reachable. The issue affects versions prior to 2026.5.27. The vulnerability relies on trusted operators opening repositories with a crafted .env file. The impact depends on the operator's configuration and the trust level of inputs reaching the affected path. A patch is available in version 2026.5.27. Until patched, it is recommended to avoid running skill install flows from untrusted workspaces and to apply configuration hardening measures.