https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T07:39:31.966263+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-41294 BREW-openclaw-cli-CVE-2026-41294 — OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover 2026-09-30T07:39:31.998214+00:00

Affected: Homebrew: openclaw-cli

## Summary

OpenClaw loaded the current working directory `.env` before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.

## Impact

A repository or workspace containing a malicious `.env` file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.

## Affected Component

`src/infra/dotenv.ts, src/cli/dotenv.ts`

## Fixed Versions

- Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `6a79324802` (`Filter untrusted CWD .env entries before OpenClaw startup`).

 https://vulnerability.circl.lu/vuln/cve-2026-41294 CVE-2026-41294 — OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File 2026-09-30T07:39:31.998332+00:00

Affected: OpenClaw

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment settings during OpenClaw startup.