PT-2026-32201
تاريخ النشر
2026-04-02
·
تاريخ التحديث
2026-04-02
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Workspace
.env can override the bundled hooks root and load attacker hook codeCurrent Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: v2026.3.28 still lets workspace .env override OPENCLAW BUNDLED HOOKS DIR, which can replace trusted default-on bundled hooks from an untrusted workspace.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
330a9f98cb29c79b1c16a2117e03d6276a0d6289— 2026-03-31T19:25:12+09:00
OpenClaw thanks @nexrin for reporting.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾