N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3qpv-xf3v-mm45

GHSA-3qpv-xf3v-mm45: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

Summary

Workspace .env can override the bundled hooks root and load attacker hook code

Current Maintainer Triage

Status: open
Normalized severity: high
Assessment: v2026.3.28 still lets workspace .env override OPENCLAW_BUNDLED_HOOKS_DIR, which can replace trusted default-on bundled hooks from an untrusted workspace.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

330a9f98cb29c79b1c16a2117e03d6276a0d6289 — 2026-03-31T19:25:12+09:00

OpenClaw thanks @nexrin for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-3qpv-xf3v-mm45

GHSA-3qpv-xf3v-mm45:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a workspace's .env file to override critical environment variables that define the location of bundled hooks, plugins, and skills (OPENCLAW_BUNDLED_HOOKS_DIR, OPENCLAW_BUNDLED_PLUGINS_DIR, OPENCLAW_BUNDLED_SKILLS_DIR). This could lead to the execution of untrusted code if a user opens a malicious project.

The patch in commit 330a9f98cb29c79b1c16a2117e03d6276a0d6289 rectifies this by introducing a blocklist, BLOCKED_WORKSPACE_DOTENV_KEYS, in src/infra/dotenv.ts. This list contains the sensitive environment variables that should not be configurable via a workspace .env file.

The functions loadWorkspaceDotEnvFile and loadCliDotEnv are the functions that read and apply the settings from .env files. Before the fix, these functions would process and load the malicious environment variables. The patch modifies their behavior to filter out the blocked keys. The associated test file, src/infra/dotenv.test.ts, was updated with tests that confirm loadWorkspaceDotEnvFile and loadCliDotEnv now correctly ignore these dangerous variables from workspace .env files, thus confirming these were the functions where the vulnerability existed.

Vulnerable functions

loadWorkspaceDotEnvFile

src/infra/dotenv.ts

This function is responsible for loading environment variables from a workspace's `.env` file. Prior to the patch, it did not have a mechanism to block certain sensitive variables, such as `OPENCLAW_BUNDLED_HOOKS_DIR`. This allowed a malicious `.env` file in a workspace to redirect the application to load and execute attacker-controlled code.

loadCliDotEnv

src/infra/dotenv.ts

This function loads the `.env` file when the OpenClaw command-line interface is used. Like `loadWorkspaceDotEnvFile`, it was vulnerable because it permitted a workspace `.env` file to override critical configuration paths, which could be exploited by an attacker to run arbitrary code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.