Executive brief
OpenClaw is a platform that executes host commands with restricted environment configurations. An incomplete blocklist of dangerous environment variables allowed attackers to override the behavior of trusted tools like Git and AWS CLI through specially crafted environment configurations, leading to arbitrary code execution when an approved command request is processed.
Technical details
The vulnerability is an incomplete input validation (CWE-184) in OpenClaw's host-env security policy. The blocklist in src/infra/host-env-security-policy.json failed to include `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` environment variables, which can be exploited to redirect git and AWS CLI to load attacker-controlled templates and configurations respectively. An authenticated user (low privilege requirement) can craft an approved exec request with these malicious environment variables set, causing the host execution environment to execute untrusted code or load attacker-controlled credentials. The fix, released in version 2026.3.28, adds these variables to the blocklist (commit 6eb82fba3c).
Affected products
- OpenClaw OpenClaw <= 2026.3.24
Timeline
- 2026-03-31: disclosed: Advisory published
- 2026-03-28: patched: Version 2026.3.28 released with fix (commit 6eb82fba3c)