CVE-2026-53846
Full vulnerability record from the local CVENow database.
Description
OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.
Severity
HIGH
CVSS score
7.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-16 19:17:01.653000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-53846",
"sourceIdentifier": "[email protected]",
"published": "2026-06-16T19:17:01.653",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment."
},
{
"lang": "es",
"value": "OpenClaw anterior a 2026.4.29 contiene una vulnerabilidad de salto de ruta en el asistente de instalación que permite que los archivos .env del espacio de trabajo anulen la configuración de npm_execpath utilizada para la instalación de dependencias de tiempo de ejecución empaquetadas. Los atacantes con acceso al espacio de trabajo pueden ejecutar ejecutables de gestor de paquetes locales no deseados durante la configuración de dependencias para comprometer el entorno de compilación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "OpenClaw",
"product": "OpenClaw",
"defaultStatus": "unaffected",
"repo": "https://github.com/openclaw/openclaw",
"packageURL": "pkg:npm/openclaw",
"versions": [
{
"version": "0",
"lessThan": "2026.4.29",
"versionType": "semver",
"status": "affected"
},
{
"version": "2026.4.29",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-18T03:55:49.608181Z",
"id": "CVE-2026-53846",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-426"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2026.4.29",
"matchCriteriaId": "FD093CBC-6B1F-481A-B12D-0E06B0F4FF8C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta1:*:*:*:node.js:*:*",
"matchCriteriaId": "06F1B1BC-A38C-40D2-A66F-BFF44FCA096E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta2:*:*:*:node.js:*:*",
"matchCriteriaId": "5253E817-4E8F-4936-B94E-432908CEF8CE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta3:*:*:*:node.js:*:*",
"matchCriteriaId": "1969F355-06D5-4313-86C7-DD91EE58F7BF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta4:*:*:*:node.js:*:*",
"matchCriteriaId": "A5AC7CB7-6639-4F11-8A81-3A35D334C762"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}