CVE-2026-28484 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.15 contains a command injection caused by improper handling of filenames in git-hooks/pre-commit hook, letting attackers inject git flags to add ignored files, exploit requires attacker to create maliciously-named files.

Severity & Score

Impact

Attackers can inject git flags to add sensitive ignored files to git history, potentially exposing sensitive information.

Mitigation

Update to version 2026.2.15 or later.

References

• https://github.com/openclaw/openclaw/commit/b88f37762f5b6d7ec0f589eb761815e466e4ef4b
• https://github.com/openclaw/openclaw/commit/ba84b1253967143692166023f9e174c149b6f2ed
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mmpf-jwf4-h3qv
• https://www.vulncheck.com/advisories/openclaw-option-injection-in-pre-commit-hook-via-malicious-filenames

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28484 - Critical (9.8) OpenClaw versions prior to 2026.2.15 contain an option injection vulnerability in the git-hooks/pre-commit hook that allows attackers to stage ignored files by creating maliciously-named files beginning with dashes. The hook fails to use a -- sepa... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28484/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner