Description
OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity.
Published: 2026-04-28
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Repository Integrity Compromise
Action: Apply Patch
AI Analysis

Impact

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment prior to host exec operations. Attackers can set GIT_DIR and related variables to redirect git operations, allowing malicious manipulation of repository contents and compromising repository integrity. This flaw represents a CWE-184 weakness, where the application fails to sanitize environment variables before using them in a security‑critical context.

Affected Systems

OpenClaw software (Node.js implementation) versions earlier than 2026.4.8 on all platforms supported by the OpenClaw project.

Risk and Exploitability

The CVSS score of 5.8 indicates a moderate risk, and no EPSS score is available, so exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, as an attacker needs the ability to set environment variables before OpenClaw executes git plumbing commands, but if the environment can be influenced remotely the risk increases. Exploitation requires only setting of GIT_DIR and related variables; no additional privileges are necessary beyond the ability to execute OpenClaw.

Generated by OpenCVE AI on April 29, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.4.8 or later.
  • Configure OpenClaw to clear or whitelist git plumbing environment variables before invoking any host exec operations.
  • Restrict the execution environment to a minimal set of trusted variables and explicitly unset GIT_DIR and related variables when launching git commands.

Generated by OpenCVE AI on April 29, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cm8v-2vh9-cxf3 OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)
History

Wed, 29 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Description OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity.
Title OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-184
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N'}

cvssV4_0

{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-29T13:15:23.536Z

Reserved: 2026-04-22T15:20:49.860Z

Link: CVE-2026-41915

cve-icon Vulnrichment

Updated: 2026-04-29T13:15:18.599Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-28T19:37:45.397

Modified: 2026-04-30T14:04:15.273

Link: CVE-2026-41915

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T01:30:06Z

Weaknesses
  • CWE-184

    Incomplete List of Disallowed Inputs