GHSA-hxvm-xjvf-93f3: OpenClaw: Workspace dotenv could override runtime-control environment variables

April 25, 2026

Workspace .env loading did not reserve the OPENCLAW_ runtime-control namespace broadly enough. A malicious workspace could set variables such as OPENCLAW_GIT_DIR before source-update or installer flows, potentially steering trusted OpenClaw runtime behavior.

This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.

References

github.com/advisories/GHSA-hxvm-xjvf-93f3
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6
github.com/openclaw/openclaw/security/advisories/GHSA-hxvm-xjvf-93f3

Code Behaviors & Features

Detect and mitigate GHSA-hxvm-xjvf-93f3 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →