PT-2026-32076
تاريخ النشر
2026-03-31
·
تاريخ التحديث
2026-03-31
الوصف من
CVSS 3.1
4.9
متوسطةالمقاييسAV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Summary
Host execution env sanitization did not block
GIT TEMPLATE DIR or AWS CONFIG FILE, even though both can redirect trusted tooling to attacker-controlled content.Impact
An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrusted code or load attacker-selected credentials.
Affected Component
src/infra/host-env-security-policy.json, src/infra/host-env-security.tsFixed Versions
- Affected:
<= 2026.3.24 - Patched:
>= 2026.3.28 - Latest stable
2026.3.28contains the fix.
Fix
Fixed by commit
6eb82fba3c (Infra: block additional host exec env keys).OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾