GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
9 advisories
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
High
CVE-2026-41384
was published
for
openclaw
(npm)
Apr 7, 2026
OpenClaw: Workspace `.env` can override the bundled plugin trust root
High
CVE-2026-41396
was published
for
openclaw
(npm)
Apr 3, 2026
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
High
CVE-2026-41336
was published
for
openclaw
(npm)
Apr 2, 2026
OpenClaw has Inconsistent Host Exec Environment Override Sanitization
High
CVE-2026-35650
was published
for
openclaw
(npm)
Mar 26, 2026
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
High
CVE-2026-32056
was published
for
openclaw
(npm)
Mar 3, 2026
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
High
GHSA-w9cg-v44m-4qv8
was published
for
openclaw
(npm)
Mar 3, 2026
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
High
CVE-2026-32003
was published
for
openclaw
(npm)
Mar 3, 2026
eBay API MCP Server Affected by Environment Variable Injection
High
CVE-2026-27203
was published
for
ebay-mcp
(npm)
Feb 19, 2026
Flowise OverrideConfig security vulnerability
High
GHSA-5cph-wvm9-45gj
was published
for
flowise
(npm)
Nov 21, 2024
ProTip!
Advisories are also available from the
GraphQL API