Executive brief
OpenClaw is a development tool that executes custom code hooks within workspaces. A vulnerability allows attackers to override the location where OpenClaw loads its default security-critical hooks by modifying workspace environment variables, enabling execution of arbitrary attacker-supplied code with user privileges. This is particularly dangerous because trusted default hooks can be replaced transparently from an untrusted workspace.
Technical details
The vulnerability is an insecure environment variable override (CWE-829) affecting OpenClaw versions before 2026.3.31. The OPENCLAW_BUNDLED_HOOKS_DIR environment variable, which specifies the directory for loading default bundled hooks, can be overridden by workspace-level .env files. An attacker can place a malicious .env file in an untrusted workspace to redirect hook loading to attacker-controlled code. The attack requires user interaction (opening/running the workspace) and local file system access. The fix is available in version 2026.3.31 and commit 330a9f98cb29c79b1c16a2117e03d6276a0d6289 restricts environment variable override behavior.
Affected products
- OpenClaw OpenClaw <= 2026.3.28
Timeline
- 2026-03-31: disclosed: Security advisory GHSA-3qpv-xf3v-mm45 published
- 2026-03-31: patched: Fix released in version 2026.3.31
- 2026-04-24: other: Duplicate advisory GHSA-jx3c-247h-cxwp published
- 2026-05-04: other: Duplicate advisory GHSA-jx3c-247h-cxwp withdrawn