A vulnerability in OpenClaw allows attackers to redirect package resolution and execute arbitrary code via environment variable manipulation, posing a significant supply chain risk.

This is a permissive input validation flaw (CWE-183) located in the environment security policy configuration files. The vulnerability allows an unauthenticated attacker to inject environment overrides that redirect package resolution or runtime bootstrapping to malicious infrastructure.

The ability to redirect package resolution enables an attacker to supply malicious or trojanized code during the build or runtime process. This bypasses supply chain integrity, potentially leading to full system compromise and the exfiltration of sensitive data. Given the CVSS score of 7.8, this flaw represents a high risk to software development environments and production infrastructure that rely on the OpenClaw package manager.

Immediate Action: Update the OpenClaw package manager to version 2026.3.22 or later to apply the necessary security sanitization patches.

Proactive Monitoring: Review build logs and environment configurations for unexpected package source redirections or unusual network traffic initiated by the package manager during deployment.

Compensating Controls: Implement strict environment variable controls and restrict the ability of build processes to modify environment parameters to prevent unauthorized overrides.

Public Exploit Available: Unknown

Organizations utilizing OpenClaw must prioritize the upgrade to version 2026.3.22 immediately. Given that this vulnerability facilitates supply chain attacks, failing to patch could lead to the silent deployment of malicious code within your infrastructure. Apply the update as soon as possible to ensure the integrity of your software development pipeline.