GitHub Advisoryadvisory · npm

GHSA-9gp8-hjxr-6f34 OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

MEDIUM Published 2026-04-03 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-41330
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-269, CWE-453
Reviewed
2026-04-03

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls Current Maintainer Triage • Status: open • Normalized severity: medium • Assessment: Real in shipped v2026.3.28: host exec env policy still missed proxy, TLS, Docker, and Git TLS variables until 4d912e0451 on 2026-03-31; maintainers already accepted it and the fix is unreleased. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `4d912e04519b4bd53b248437c53748cdebce9a41` — 2026-03-31T21:25:36+09:00 OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41330 OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy,… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-453 Insecure Default Variable Initialization weakness

References