N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g8xp-qx39-9jq9

GHSA-g8xp-qx39-9jq9: OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides

Summary

Incomplete host-env-security-policy.json allows untrusted model to substitute compiler binaries (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) via env overrides on approved host exec requests

Current Maintainer Triage

Status: narrow
Normalized severity: medium
Assessment: Shipped v2026.3.28 host-env policy missed compiler override vars, but exploitation still requires an approved host-exec request inside the existing exec trust domain, so medium not high.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

e277a37f896b5011a1df06e6490c6630074d0afa — 2026-03-30T20:06:32+01:00

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g8xp-qx39-9jq9

GHSA-g8xp-qx39-9jq9:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an incomplete blocklist of dangerous environment variables located in src/infra/host-env-security-policy.json. This allowed an attacker to override compiler-related environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER, CMAKE_CXX_COMPILER) for host execution requests. The patch addresses this by adding these variables to the blocklist.

The primary function responsible for enforcing this security policy is sanitizeHostExecEnv, which is located in src/infra/host-env-security.ts. This function takes a set of environment variable overrides and is supposed to strip any dangerous variables before they are used to execute commands on the host. Because the blocklist was incomplete, sanitizeHostExecEnv would fail to remove the malicious compiler overrides. The test file src/infra/host-env-security.test.ts was updated to verify that sanitizeHostExecEnv now correctly removes these variables.

A helper function, isDangerousHostEnvVarName, is used to check if a given environment variable is on the blocklist. This function was also implicitly vulnerable due to the incomplete blocklist. The updated tests confirm it now correctly identifies the compiler-related variables as dangerous.

Therefore, during exploitation, a profiler would likely show sanitizeHostExecEnv being called, which would then (prior to the patch) fail to sanitize the environment, leading to the execution of a malicious compiler.

Vulnerable functions

sanitizeHostExecEnv

src/infra/host-env-security.ts

This function is responsible for sanitizing environment variables before executing host commands. Prior to the patch, it did not filter out compiler-related environment variables like 'CC', 'CXX', etc. This allowed an untrusted model to specify a malicious compiler binary to be executed during build processes that are triggered by approved host-exec requests.

isDangerousHostEnvVarName

src/infra/host-env-security.ts

This function is used to determine if an environment variable name is considered dangerous. It was vulnerable because it did not include compiler-related environment variables in its list of dangerous variables, leading to them not being sanitized by functions like 'sanitizeHostExecEnv'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.