{"action":"Upgrade openclaw to 2026.4.8 or later.","affected":[{"fixed":"2026.4.8","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41915"],"ecosystem":"npm","epss":0.00115,"exploited":false,"fixed_versions":["2026.4.8"],"ghsa_id":"GHSA-cm8v-2vh9-cxf3","id":"tcs_01M5KFK387QKQ5ZHH2RHNKQJ2R","modified_at":"2026-05-06T02:47:34.230339Z","published_at":"2026-04-09T20:28:32Z","references":["https://osv.dev/vulnerability/GHSA-cm8v-2vh9-cxf3","https://github.com/openclaw/openclaw/security/advisories/GHSA-cm8v-2vh9-cxf3","https://nvd.nist.gov/vuln/detail/CVE-2026-41915","https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-git-environment-variable-injection-via-unfiltered-exec-environment"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cm8v-2vh9-cxf3","url":"https://osv.dev/vulnerability/GHSA-cm8v-2vh9-cxf3"}],"summary":"OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)"}