CVE-2026-28484

CRITICAL9.8

OpenClaw 2026.2.15 - Option Injection in pre-commit Hook via Malicious Filenames

Published Mar 5, 2026

Modified 1 weeks ago

Details

OpenClaw versions prior to 2026.2.15 contain an option injection vulnerability in the git-hooks/pre-commit hook that allows attackers to stage ignored files by creating maliciously-named files beginning with dashes. The hook fails to use a -- separator when piping filenames through xargs to git add, enabling attackers to inject git flags and add sensitive ignored files like .env to git history.

References

FIX

https://github.com/openclaw/openclaw/commit/b88f37762f5b6d7ec0f589eb761815e466e4ef4b

FIX

https://github.com/openclaw/openclaw/commit/ba84b1253967143692166023f9e174c149b6f2ed

ADVISORY

https://github.com/openclaw/openclaw/security/advisories/GHSA-mmpf-jwf4-h3qv

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-28484

ADVISORY

https://www.vulncheck.com/advisories/openclaw-option-injection-in-pre-commit-hook-via-malicious-filenames

CVSS Analysis