Listen to this Post
The vulnerability arises from OpenClaw’s startup sequence, which loads a `.env` file from the current working directory (CWD) before it reads its trusted state‑directory configuration. In affected versions (≤ 2026.3.24), the `src/infra/dotenv.ts` and `src/cli/dotenv.ts` modules prioritize the CWD `.env` over the host‑defined environment and the secure state‑dir policy. An attacker who places a malicious `.env` in a repository or workspace can inject arbitrary environment variables (e.g., OPENCLAW_CONFIG, NODE_OPTIONS, or API keys) that override runtime configuration. Because the loading occurs early during process initialization, the injected values bypass the host‑enforced environment policy and can lead to full configuration takeover, including altering security settings, redirecting data paths, or executing untrusted code. The fix (commit 6a79324802) filters out environment variables originating from the CWD `.env` before the application trusts any configuration, ensuring that only the state‑directory and system‑provided values are respected.
Platform: OpenClaw
Version: <= 2026.3.24
Vulnerability : Environment variable injection
Severity: Critical
date: Mar 29 2026
Prediction: March 28 2026
What Undercode Say:
Check for malicious .env in current directory ls -la .env Simulate injection attempt echo "OPENCLAW_CONFIG=/tmp/malicious.json" > .env openclaw start Verify loaded environment (example) cat /proc/$(pgrep openclaw)/environ | tr '\0' '\n' | grep OPENCLAW_CONFIG
Exploit:
- Create a repository/workspace with a crafted `.env` containing `OPENCLAW_CONFIG=malicious.conf` or
PATH=/evil/bin:$PATH.
2. Execute OpenClaw from that directory.
- The CWD `.env` is loaded before the host policy, overriding trusted settings and enabling configuration takeover.
Protection from this CVE
- Upgrade to OpenClaw ≥ 2026.3.28.
- Avoid running OpenClaw in untrusted directories.
- If immediate upgrade is impossible, remove or monitor all `.env` files in workspace roots.
Impact
- Unauthenticated local code execution via environment hijack.
- Bypass of host‑enforced environment security policies.
- Complete configuration takeover, potentially leading to data exfiltration or privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
