{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/env-override/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["openclaw","env-override","hook-injection"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003eopenclaw\u003c/code\u003e package, a yet-to-be-defined tool, is vulnerable to a critical flaw affecting versions 2026.3.28 and earlier. This vulnerability stems from the application's susceptibility to having its default hook directory, designated by the \u003ccode\u003eOPENCLAW_BUNDLED_HOOKS_DIR\u003c/code\u003e environment variable, overridden by settings defined within a workspace's \u003ccode\u003e.env\u003c/code\u003e file. An attacker could leverage this vulnerability within an untrusted workspace to replace trusted, default-on bundled hooks with malicious code. Version 2026.3.31 resolves this issue. This vulnerability was reported by @nexrin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to or creates a workspace where OpenClaw is used.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious \u003ccode\u003e.env\u003c/code\u003e file within the workspace.\u003c/li\u003e\n\u003cli\u003eThe malicious \u003ccode\u003e.env\u003c/code\u003e file defines \u003ccode\u003eOPENCLAW_BUNDLED_HOOKS_DIR\u003c/code\u003e and sets it to a directory controlled by the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker places malicious hook scripts (e.g., JavaScript, Python, or shell scripts) within the attacker-controlled directory. These scripts are designed to execute arbitrary code.\u003c/li\u003e\n\u003cli\u003eWhen OpenClaw initializes within the workspace, it reads the \u003ccode\u003e.env\u003c/code\u003e file and uses the attacker-controlled directory as the location for bundled hooks, instead of the intended secure location.\u003c/li\u003e\n\u003cli\u003eOpenClaw executes the malicious hook scripts as part of its normal operation.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves code execution within the context of the OpenClaw process.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the code execution to establish persistence or escalate privileges on the affected system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code within the context of the OpenClaw application. Depending on how OpenClaw is implemented and the privileges it operates with, this could lead to complete system compromise. This could impact any environment where OpenClaw is used to manage or automate tasks within workspaces.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eopenclaw\u003c/code\u003e package to version 2026.3.31 or later to patch the vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor for modifications to \u003ccode\u003e.env\u003c/code\u003e files within OpenClaw workspaces, looking for changes to the \u003ccode\u003eOPENCLAW_BUNDLED_HOOKS_DIR\u003c/code\u003e environment variable. Deploy the \u0026quot;Detect OpenClaw Bundled Hooks Override via .env\u0026quot; Sigma rule to detect this.\u003c/li\u003e\n\u003cli\u003eImplement strict access controls on OpenClaw workspaces to prevent unauthorized users from modifying \u003ccode\u003e.env\u003c/code\u003e files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-02T21:00:16Z","date_published":"2026-04-02T21:00:16Z","id":"https://feed.craftedsignal.io/briefs/2026-04-02-openclaw-env-override/","summary":"The openclaw package is vulnerable to a high severity issue where a workspace's `.env` file can override the `OPENCLAW_BUNDLED_HOOKS_DIR`, allowing attackers to replace trusted hooks with malicious code.","title":"OpenClaw Workspace .env Hook Override Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-02-openclaw-env-override/"}],"language":"en","title":"CraftedSignal Threat Feed - Env-Override","version":"https://jsonfeed.org/version/1.1"}