OpenClaw fails to sanitize the PIP_INDEX_URL and UV_INDEX_URL environment variables when executed in a host context, permitting an attacker to override the Python package index URL. By injecting a malicious URL, the attacker can redirect package management traffic to a compromised repository, allowing the delivery of tampered or malicious packages to a target system. This flaw represents a defect in information access control, enabling unauthorized manipulation of package sources and potentially enabling further compromise through package delivery.

All versions of OpenClaw older than 2026.3.31 are affected. The vulnerability has been reported in the OpenClaw product supplied under the OpenClaw:OpenClaw vendor designation.

The base CVSS score of 5.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. The most likely attack vector involves an attacker with the ability to set or influence environment variables in the host execution context; this could occur from local compromised credentials or from a compromised build environment. Exploitation would require injecting a malicious URL into PIP_INDEX_URL or UV_INDEX_URL, after which OpenClaw would redirect package downloads to the attacker’s controlled index.