Количество 2
Количество 2
CVE-2026-41336
OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted workspaces to execute arbitrary code.
GHSA-3qpv-xf3v-mm45
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-41336 OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted workspaces to execute arbitrary code. | CVSS3: 7.8 | 0% Низкий | 5 месяцев назад |
| GHSA-3qpv-xf3v-mm45 OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
Уязвимостей на страницу