Attack Chain

1. An attacker gains access to or creates a workspace where OpenClaw is used.
2. The attacker crafts a malicious .env file within the workspace.
3. The malicious .env file defines OPENCLAW_BUNDLED_HOOKS_DIR and sets it to a directory controlled by the attacker.
4. The attacker places malicious hook scripts (e.g., JavaScript, Python, or shell scripts) within the attacker-controlled directory. These scripts are designed to execute arbitrary code.
5. When OpenClaw initializes within the workspace, it reads the .env file and uses the attacker-controlled directory as the location for bundled hooks, instead of the intended secure location.
6. OpenClaw executes the malicious hook scripts as part of its normal operation.
7. The attacker achieves code execution within the context of the OpenClaw process.
8. The attacker leverages the code execution to establish persistence or escalate privileges on the affected system.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the context of the OpenClaw application. Depending on how OpenClaw is implemented and the privileges it operates with, this could lead to complete system compromise. This could impact any environment where OpenClaw is used to manage or automate tasks within workspaces.

Recommendation

• Upgrade the openclaw package to version 2026.3.31 or later to patch the vulnerability.
• Monitor for modifications to .env files within OpenClaw workspaces, looking for changes to the OPENCLAW_BUNDLED_HOOKS_DIR environment variable. Deploy the "Detect OpenClaw Bundled Hooks Override via .env" Sigma rule to detect this.
• Implement strict access controls on OpenClaw workspaces to prevent unauthorized users from modifying .env files.