OpenClaw Incomplete Host Environment Variable Sanitization Vulnerability Allowing Supply-Chain Redirection

A vulnerability exists in OpenClaw versions prior to 2026.3.22, due to incomplete sanitization of host environment variables in the files host-env-security-policy.json and host-env-security.ts. This flaw allows package-manager environment overrides. Attackers can exploit approved execution requests to redirect package resolution or runtime initialization to infrastructure they control, potentially executing malicious content.

Impact

Exploitation of this vulnerability could lead to unauthorized redirection of package management processes, allowing the execution of trojanized content on the affected system.

Remediation

Users can upgrade to OpenClaw version 2026.3.22 or later to address this vulnerability.