OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts …

OpenClaw versions before 2026.3.22 contain an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts files. This vulnerability allows attackers to override package-manager environment variables through approved exec requests. Attackers can exploit this to redirect package resolution or runtime bootstrap processes to attacker-controlled infrastructure. The vulnerability enables execution of trojanized content through supply chain attacks. This represents a significant supply chain security risk for applications using affected OpenClaw versions.