GHSA-m866-6qv5-p2fg: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

March 31, 2026

Host execution env sanitization did not block GIT_TEMPLATE_DIR or AWS_CONFIG_FILE, even though both can redirect trusted tooling to attacker-controlled content.

References

github.com/advisories/GHSA-m866-6qv5-p2fg
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/6eb82fba3cbfd0e50b179c1fada92e1e22dce7fa
github.com/openclaw/openclaw/security/advisories/GHSA-m866-6qv5-p2fg

Code Behaviors & Features

Detect and mitigate GHSA-m866-6qv5-p2fg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →