{"action":"Upgrade openclaw to 2026.3.28 or later.","affected":[{"fixed":"2026.3.28","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41332"],"ecosystem":"npm","epss":0.00105,"exploited":false,"fixed_versions":["2026.3.28"],"ghsa_id":"GHSA-m866-6qv5-p2fg","id":"tcs_01M5KG04F0Q0PBEMA8SG54B4JW","modified_at":"2026-05-06T23:41:29.549594Z","published_at":"2026-03-31T23:57:00Z","references":["https://osv.dev/vulnerability/GHSA-m866-6qv5-p2fg","https://github.com/openclaw/openclaw/security/advisories/GHSA-m866-6qv5-p2fg","https://github.com/openclaw/openclaw/commit/6eb82fba3cbfd0e50b179c1fada92e1e22dce7fa","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-code-execution-via-missing-environment-variable-blocklist"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-m866-6qv5-p2fg","url":"https://osv.dev/vulnerability/GHSA-m866-6qv5-p2fg"}],"summary":"OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override"}