Threats tagged 'ghsa-vfw7-6rhc-6xxg'

OpenClaw versions prior to 2026.3.24 contain a high-severity vulnerability (CVE-2026-41384) involving environment variable injection in the CLI backend via malicious workspace configuration. This flaw allows an attacker to inject environment variables into the CLI backend runner, potentially leading to high impact on confidentiality, integrity, and availability. The issue is fixed starting from version 2026.3.24 by sanitizing the backend environment before process spawn.