OpenClaw Option Injection Vulnerability in Git Hooks Pre-commit Hook

An option injection vulnerability has been identified in OpenClaw versions prior to 2026.2.15. This vulnerability resides in the git-hooks/pre-commit hook, where the absence of a proper separator allows attackers to inject git options. By creating files with names that begin with dashes, attackers can manipulate the hook into staging ignored files, such as .env files, and inadvertently add them to git history.

Impact

Exploitation of this vulnerability allows for the injection of git options, potentially leading to the staging of sensitive ignored files and their inclusion in git history.

Remediation

Users can update to OpenClaw version 2026.2.15 or later to address this vulnerability.