Threats tagged 'ghsa-j7p2-qcwm-94v4'

OpenClaw versions prior to 2026.3.22 contain a vulnerability in the host environment sanitization logic that fails to block certain package-manager and related environment variables. This flaw allows an attacker, upon an approved execution request, to redirect package resolution or runtime bootstrap processes to attacker-controlled infrastructure, potentially leading to execution of malicious code. The issue is fixed in version 2026.3.22.