GHSA-j7p2-qcwm-94v4: OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

March 31, 2026

Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior.

References

github.com/advisories/GHSA-j7p2-qcwm-94v4
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/7abfff756d6c68d17e21d1657bbacbaec86de232
github.com/openclaw/openclaw/releases/tag/v2026.3.22
github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4

Code Behaviors & Features

Detect and mitigate GHSA-j7p2-qcwm-94v4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →