OpenClaw before 2026.3.31 is vulnerable because it allows the OPENCLAW_BUNDLED_HOOKS_DIR environment variable to be overridden by an attacker supplied workspace .env file. The override causes the application to load hook code from directories specified by the attacker rather than the trusted default hooks. This permits an attacker to inject and execute arbitrary code on the host running the workspace. The vulnerability originates from inadequate access control over environment configuration, matching CWE-829.

Any installation of OpenClaw older than version 2026.3.31 is impacted; all other versions are considered safe.

The CVSS score of 8.5 indicates a high severity flaw, while the EPSS score of less than 1% shows that, as of now, exploitation is unlikely to be widespread. Nonetheless, because an attacker only needs to supply a crafted .env file in a workspace, the server could load malicious hook code and execute it without further interaction. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of existing widespread exploits, yet the potential for uncontrolled code execution remains significant, especially in environments where workspaces are created or managed by trusted users only.