CVE-2026-41915: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41915 is a git plumbing environment variable injection vulnerability in OpenClaw (npm package) that allows local low-privilege attackers to redirect git operations and compromise repository integrity. The flaw affects all OpenClaw versions up to and including 2026.3.30, with the fix available in version 2026.4.8. It was published on April 28, 2026, and is classified as Medium severity with a CVSS v3.1 base score of 6.1 and a CVSS v4.0 base score of 5.8 (GitHub Advisory, Feedly).

The root cause is an incomplete denylist (CWE-184) — and additionally improper OS command neutralization (CWE-78) — where OpenClaw fails to strip git plumbing environment variables such as GIT_DIR from the execution environment before performing host exec operations. An attacker with local access can pre-set or manipulate these environment variables to redirect git operations to an attacker-controlled repository path, effectively hijacking git commands invoked by the application. The vulnerability is a variant of GHSA-m866-6qv5-p2fg and was reported by @boy-hack of Tencent Zhuque Lab. The fix (commit d7c3210) addresses the sanitization gap in the exec environment handling (GitHub Advisory, GitHub Commit).

Successful exploitation allows a local attacker to redirect git operations to an arbitrary repository, enabling unauthorized modification of repository contents and compromising code integrity. The primary impact is high integrity loss — an attacker could inject malicious code into repositories processed by OpenClaw — with a low confidentiality impact (e.g., reading repository data from redirected paths). Availability is not directly affected. Because OpenClaw is described as a user-controlled local assistant, the scope is limited to the local trust boundary rather than a multi-tenant service (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability requires local access and low privileges, which further limits its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Gain local access: Obtain a low-privilege local account on a system running a vulnerable version of OpenClaw (≤2026.3.30).
2. Identify OpenClaw exec operations: Determine when and how OpenClaw invokes git commands (e.g., during repository operations or assistant workflows).
3. Set malicious environment variables: Before triggering an OpenClaw operation, set GIT_DIR (and optionally related variables such as GIT_WORK_TREE, GIT_INDEX_FILE) to point to an attacker-controlled directory: export GIT_DIR=/tmp/attacker-repo/.git.
4. Trigger OpenClaw git operation: Invoke an OpenClaw action that internally calls a git command (e.g., a commit, status check, or repository scan).
5. Redirect git operations: Because OpenClaw does not sanitize these variables from the exec environment, the git subprocess uses the attacker-supplied GIT_DIR, operating on the attacker-controlled repository instead of the intended one.
6. Compromise repository integrity: Use the redirected git context to inject malicious commits, alter history, or read repository data from the redirected path (GitHub Advisory).

• Process/Environment: Presence of GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, or other git plumbing environment variables set to unexpected paths in the environment of OpenClaw or its child processes.
• File System: Unexpected .git directories in non-standard locations (e.g., /tmp, user home subdirectories) that coincide with OpenClaw execution times; unusual git object files or refs in attacker-controlled paths.
• Logs: System or application logs showing git subprocess invocations with environment variables pointing to non-project directories; audit logs (e.g., auditd) recording execve calls with suspicious GIT_DIR values.
• Process: Child git processes spawned by OpenClaw operating on unexpected working directories or repository paths.

Users should upgrade OpenClaw (npm) to version 2026.4.8 or later, which removes git plumbing environment variables from the exec environment before host operations. The verified fix is available at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. As an interim measure, restrict local system access to trusted users only and monitor for suspicious git environment variable manipulation. No configuration-only workaround is available that fully mitigates the issue without patching (GitHub Advisory, GitHub Commit).

The vulnerability was reported by @boy-hack of Tencent Zhuque Lab (AI-Infra-Guard project) and credited in the official GitHub Security Advisory. The advisory was published by maintainer steipete and notes it is a variant of a previously disclosed issue (GHSA-m866-6qv5-p2fg), suggesting awareness of this class of environment variable injection flaws in the project. No significant broader media coverage or social media discussion has been observed beyond standard CVE aggregator publications (GitHub Advisory).