CVE-2026-53846

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf	Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openclaw:openclaw::::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta1::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta2::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta3::::node.js::*
	cpe:2.3:a:openclaw:openclaw:2026.4.29:beta4::::node.js::*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) OpenClaw anterior a 2026.4.29 contiene una vulnerabilidad de salto de ruta en el asistente de instalación que permite que los archivos .env del espacio de trabajo anulen la configuración de npm_execpath utilizada para la instalación de dependencias de tiempo de ejecución empaquetadas. Los atacantes con acceso al espacio de trabajo pueden ejecutar ejecutables de gestor de paquetes locales no deseados durante la configuración de dependencias para comprometer el entorno de compilación.

Information

Published : 2026-06-16 19:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-53846

Mitre link : CVE-2026-53846

CVE.ORG link : CVE-2026-53846

JSON object : View

Products Affected

openclaw

openclaw

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2026-53846", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53846", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-18T03:55:49.608181Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/openclaw/openclaw", "vendor": "OpenClaw", "product": "OpenClaw", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.4.29", "versionType": "semver"}, {"status": "unaffected", "version": "2026.4.29", "versionType": "semver"}], "packageURL": "pkg:npm/openclaw", "defaultStatus": "unaffected"}]}], "published": "2026-06-16T19:17:01.653", "references": [{"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment."}, {"lang": "es", "value": "OpenClaw anterior a 2026.4.29 contiene una vulnerabilidad de salto de ruta en el asistente de instalaci\u00f3n que permite que los archivos .env del espacio de trabajo anulen la configuraci\u00f3n de npm_execpath utilizada para la instalaci\u00f3n de dependencias de tiempo de ejecuci\u00f3n empaquetadas. Los atacantes con acceso al espacio de trabajo pueden ejecutar ejecutables de gestor de paquetes locales no deseados durante la configuraci\u00f3n de dependencias para comprometer el entorno de compilaci\u00f3n."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FD093CBC-6B1F-481A-B12D-0E06B0F4FF8C", "versionEndExcluding": "2026.4.29"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "06F1B1BC-A38C-40D2-A66F-BFF44FCA096E"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5253E817-4E8F-4936-B94E-432908CEF8CE"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1969F355-06D5-4313-86C7-DD91EE58F7BF"}, {"criteria": "cpe:2.3:a:openclaw:openclaw:2026.4.29:beta4:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A5AC7CB7-6639-4F11-8A81-3A35D334C762"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}