N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7ggg-pvrf-458v

GHSA-7ggg-pvrf-458v: OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Summary

PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Current Maintainer Triage

Status: narrow
Normalized severity: high
Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay limited to approved or allowlisted package-management exec paths, not arbitrary remote execution.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

7ae1bb0c7799fd0cbd2d4de7b0f5b8039837ab8d — 2026-03-31T09:53:32+09:00

OpenClaw thanks @nexrin for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7ggg-pvrf-458v

GHSA-7ggg-pvrf-458v:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incomplete sanitization of environment variables passed to host execution environments. Specifically, the functions sanitizeHostExecEnv and sanitizeHostExecEnvWithDiagnostics in src/infra/host-env-security.ts were not configured to block environment variables like PIP_INDEX_URL and UV_INDEX_URL. These functions rely on a blocklist defined in src/infra/host-env-security-policy.json and a helper function isDangerousHostEnvOverrideVarName to determine which variables to remove. Before the patch, this blocklist was missing the Python and UV package index URL override variables. An attacker could therefore provide specially crafted values for these environment variables to redirect pip or uv package manager traffic to a malicious repository, leading to the installation of malicious packages and potential remote code execution. The fix involved updating the blocklist in src/infra/host-env-security-policy.json to include these dangerous variables, thereby ensuring the sanitization functions correctly identify and remove them.

Vulnerable functions

sanitizeHostExecEnv

src/infra/host-env-security.ts

This function is responsible for sanitizing environment variables for host execution. Before the patch, it failed to remove environment variables such as `PIP_INDEX_URL` and `UV_INDEX_URL`, which could allow an attacker to redirect package installations to a malicious index. The patch added tests to ensure these variables are removed.

isDangerousHostEnvOverrideVarName

src/infra/host-env-security.ts

This function checks if an environment variable is considered dangerous. Before the patch, it did not identify Python package index override variables as dangerous, causing the sanitization functions to ignore them. The patch updated the logic (by updating the blocklist it uses) to correctly identify these variables.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.