https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:56:48.028158+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41373 BREW-openclaw-cli-CVE-2026-41373 — OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides 2026-10-05T23:56:48.107390+00:00

Affected: Homebrew: openclaw-cli

## Summary Incomplete `host-env-security-policy.json` allows untrusted model to substitute compiler binaries (`CC`, `CXX`, `CARGO_BUILD_RUSTC`, `CMAKE_C_COMPILER`) via env overrides on approved host exec requests

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Shipped v2026.3.28 host-env policy missed compiler override vars, but exploitation still requires an approved host-exec request inside the existing exec trust domain, so medium not high.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `e277a37f896b5011a1df06e6490c6630074d0afa` — 2026-03-30T20:06:32+01:00

OpenClaw thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-307800 EUVD-2026-307800 2026-10-05T23:56:48.107501+00:00 EUVD-2026-307800 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41373 fkie_cve-2026-41373 2026-10-05T23:56:48.107518+00:00

OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models to substitute CC, CXX, CARGO_BUILD_RUSTC, and CMAKE_C_COMPILER via environment overrides. Attackers with approved host-exec requests can override compiler binaries to execute arbitrary code during build processes.

 https://cve.radiocsirt.org/vuln/ghsa-g8xp-qx39-9jq9 GHSA-g8xp-qx39-9jq9 — OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides 2026-10-05T23:56:48.107543+00:00

Affected: npm: openclaw

## Summary Incomplete `host-env-security-policy.json` allows untrusted model to substitute compiler binaries (`CC`, `CXX`, `CARGO_BUILD_RUSTC`, `CMAKE_C_COMPILER`) via env overrides on approved host exec requests

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Shipped v2026.3.28 host-env policy missed compiler override vars, but exploitation still requires an approved host-exec request inside the existing exec trust domain, so medium not high.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `e277a37f896b5011a1df06e6490c6630074d0afa` — 2026-03-30T20:06:32+01:00

OpenClaw thanks @tdjackey for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T23:56:48.107575+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.