Executive brief
OpenClaw is a development tool that manages project workspaces and runtime environments. A malicious workspace's .env configuration file could inject restricted environment variables (prefixed with OPENCLAW_) that override the tool's internal runtime controls, potentially redirecting code repositories or altering installer behavior. This requires an attacker to control the workspace itself, limiting immediate risk but affecting developers who clone or open untrusted projects.
Technical details
The vulnerability is an incomplete input validation flaw (CWE-184) in OpenClaw's workspace .env file loader. The tool fails to broadly reserve the OPENCLAW_ environment variable namespace, allowing a malicious .env file to set restricted variables such as OPENCLAW_GIT_DIR before source-update or installer flows execute. An attacker must have control over the workspace files (local attack surface, no network or authentication bypass required). By injecting these variables, an attacker can steer OpenClaw's trusted runtime behavior during dependency resolution or installation. OpenClaw 2026.4.20 and later patch the issue by rejecting workspace dotenv entries for all OPENCLAW_ runtime-control variables.
Affected products
- OpenClaw openclaw < 2026.4.20
Timeline
- 2026-04-25: disclosed: Advisory published on GitHub
- 2026-04-20: patched: Patched in OpenClaw 2026.4.20