CVE-2026-41915CWE-184

OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment

Medium · published April 28, 2026

CVSS v4.0
5.8
EPSS
0%
Percentile
6.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity.

The record
Technical detail
CVSS v4.0
5.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00170 · 6.1th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment
    cvelistv5