GHSA-j9pv-rrcj-6pfx: OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

April 2, 2026

SSH-based sandbox backends pass unsanitized process.env to child processes

References

github.com/advisories/GHSA-j9pv-rrcj-6pfx
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/cfe14459531e002a1c61c27d97ec7dc8aecddc1f
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-j9pv-rrcj-6pfx

Code Behaviors & Features

Detect and mitigate GHSA-j9pv-rrcj-6pfx with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →