Threats tagged 'ghsa-g8xp-qx39-9jq9'

OpenClaw versions up to 2026.3.28 have an incomplete host environment security policy that allows an untrusted model to override compiler binary environment variables (such as CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) during approved host execution requests. This vulnerability is mitigated in version 2026.3.31 and later. Exploitation requires an approved host-exec request within the existing execution trust domain, limiting the severity to medium.