CVE-2026-43531
1 advisory.
npm/openclaw CVE-2026-43531: high 8.8
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables
Action: Upgrade openclaw to 2026.4.9 or later.
npm i openclaw@2026.4.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.4.9 | - |
Fixed versions
| 2026.4.9 |
Sources
- osv: GHSA-7wv4-cc7p-jhxc
- https://github.com/openclaw/openclaw/security/advisories/GHSA-7wv4-cc7p-jhxc
- https://nvd.nist.gov/vuln/detail/CVE-2026-43531
- https://github.com/openclaw/openclaw/pull/62660
- https://github.com/openclaw/openclaw/commit/dbfcef319618158fa40b31cdac386ea34c392c0c
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-workspace-env-file
CVE-2026-43531 · published · modified · JSON