CVE-2026-43531

Katalog CVE

CVSS 8.8 · High EPSS 0,35%

Kerentanan External Control of System or Configuration Setting pada openclaw. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise application behavior.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-15: External Control of System or Configuration Setting

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-7wv4-cc7p-jhxc advisory vendor
• https://github.com/openclaw/openclaw/commit/dbfcef319618158fa40b31cdac386ea34c392c0c patch
• https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-workspace-env-file advisory pihak ketiga