GHSA-3qpv-xf3v-mm45: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

April 2, 2026

Workspace .env can override the bundled hooks root and load attacker hook code

References

github.com/advisories/GHSA-3qpv-xf3v-mm45
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-3qpv-xf3v-mm45

Code Behaviors & Features

Detect and mitigate GHSA-3qpv-xf3v-mm45 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →