GHSA-g8xp-qx39-9jq9: OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides

April 3, 2026

Incomplete host-env-security-policy.json allows untrusted model to substitute compiler binaries (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) via env overrides on approved host exec requests

References

github.com/advisories/GHSA-g8xp-qx39-9jq9
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/e277a37f896b5011a1df06e6490c6630074d0afa
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-g8xp-qx39-9jq9

Code Behaviors & Features

Detect and mitigate GHSA-g8xp-qx39-9jq9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →