Threats tagged 'ghsa-m866-6qv5-p2fg'

OpenClaw had a vulnerability where the host execution environment sanitization did not block the environment variables GIT_TEMPLATE_DIR and AWS_CONFIG_FILE. These variables can redirect trusted tools like git and AWS CLI to attacker-controlled configurations, potentially allowing execution of untrusted code or loading attacker-selected credentials. The issue affects OpenClaw versions up to 2026.3.24 and is fixed in version 2026.3.28.