Executive brief
OpenClaw is a local AI assistant that executes commands on behalf of users. The application failed to filter dangerous Git environment variables (like GIT_DIR) before executing system commands, allowing a local user to redirect Git operations to malicious repositories or manipulate how Git behaves during command execution. This could lead to arbitrary code execution or tampering with version control operations.
Technical details
OpenClaw improperly sanitizes the environment before calling system exec(), failing to remove Git plumbing environment variables such as GIT_DIR from the execution context. This is an incomplete denylist issue (CWE-184) that compounds an OS command injection vulnerability (CWE-78). A local attacker with user privileges can craft a malicious environment where Git operations invoked during command execution are redirected through attacker-controlled repositories or configuration. The vulnerability requires local access and user interaction to set up the environment, but once triggered, allows injection of arbitrary commands via git hooks or configuration. The fix (commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5) properly filters these environment variables before exec, and a patched version (2026.4.8) is available.
Affected products
- OpenClaw OpenClaw <=2026.3.30
Timeline
- 2026-04-09: disclosed
- 2026-04-08: patched: Fix available in version 2026.4.8