N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qcj9-wwgw-6gm8

GHSA-qcj9-wwgw-6gm8: OpenClaw: Workspace `.env` can override the bundled plugin trust root

Summary

Workspace .env can override the bundled plugin trust root

Current Maintainer Triage

Status: open
Normalized severity: high
Assessment: v2026.3.28 still lets workspace .env override OPENCLAW_BUNDLED_PLUGINS_DIR, but critical is too high because exploitation still depends on attacker-controlled workspace loading, not a universal remote break.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

330a9f98cb29c79b1c16a2117e03d6276a0d6289 — 2026-03-31T19:25:12+09:00

OpenClaw thanks @nexrin for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qcj9-wwgw-6gm8

GHSA-qcj9-wwgw-6gm8:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of environment variables from workspace .env files. An attacker could define OPENCLAW_BUNDLED_PLUGINS_DIR, OPENCLAW_BUNDLED_HOOKS_DIR, or OPENCLAW_BUNDLED_SKILLS_DIR in a .env file within a project. When the OpenClaw CLI is run within that project's directory, the loadCliDotEnv function is called, which in turn calls loadWorkspaceDotEnvFile. This function would previously load these environment variables, pointing the application to load and execute potentially malicious plugins, hooks, or skills from an attacker-controlled directory. The patch addresses this by adding these specific environment variables to a blocklist, BLOCKED_WORKSPACE_DOTENV_KEYS, which is checked within the environment loading functions to prevent them from being overridden by a workspace .env file.

Vulnerable functions

loadWorkspaceDotEnvFile

src/infra/dotenv.ts

This function is responsible for loading environment variables from a workspace's `.env` file. Before the patch, it did not block dangerous environment variables like `OPENCLAW_BUNDLED_PLUGINS_DIR`, allowing an attacker to control the plugin directory and execute arbitrary code.

loadCliDotEnv

src/infra/dotenv.ts

This function is called on CLI startup and is responsible for loading the environment configuration, which includes loading the workspace's `.env` file via `loadWorkspaceDotEnvFile`. An attacker could exploit this by providing a malicious `.env` file in a workspace, which would then be loaded when a user runs the CLI in that workspace.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.