Executive brief
OpenClaw is a npm package that sanitizes environment variables when executing system commands. An attacker can bypass this sanitization by setting PIP_INDEX_URL or UV_INDEX_URL environment variables to redirect Python package downloads to a malicious server. This could allow an attacker to inject backdoored Python packages into builds, compromising application integrity and potentially enabling supply-chain attacks.
Technical details
The vulnerability exists in OpenClaw's host execution environment sanitization, which fails to properly filter PIP_INDEX_URL and UV_INDEX_URL environment variables. These variables control where Python package managers (pip and uv) fetch packages from. An attacker with ability to set environment variables can redirect package downloads to attacker-controlled repositories. The vulnerability affects versions ≤2026.3.28, and patches are available in version 2026.3.31 and later. The attack vector is local with low privilege requirements, as the attacker needs to set environment variables in the execution context.
Affected products
- OpenClaw openclaw <=2026.3.28
Timeline
- 2026-04-02: disclosed: Advisory published
- 2026-03-31: patched: Fix commit merged; patched in version 2026.3.31
- 2026-04-28: other: NVD published