GitHub Advisoryadvisory · Go

GHSA-fm77-94qm-4894 Crabbox: environment variable exposure vulnerability

CRITICAL Published 2026-05-14 Modified 2026-07-21 Official page ↗
Aliases
CVE-2026-8634
Ecosystem
Go
Packages
github.com/openclaw/crabbox
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-94
Reviewed
2026-05-21

Affected packages

• Go github.com/openclaw/crabbox: < 0.12.0 → fixed in 0.12.0

Description

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.

Related

Alias · CVE (1)

  • CVE-2026-8634 Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References