Medium severity6.7NVD Advisory· Published Apr 23, 2026· Updated May 1, 2026

CVE-2026-41360

Description

OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. Attackers can replace approved local scripts before execution without invalidating the approval plan, allowing execution of modified script contents.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.2
- (no CPE)range: <2026.4.2

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/176c059b05357df1bc09d4328a2380670859eeffnvdPatch
github.com/openclaw/openclaw/security/advisories/GHSA-w6wx-jq6j-6mcjnvdVendor Advisory
www.vulncheck.com/advisories/openclaw-approval-integrity-bypass-in-pnpm-dlx-local-script-bindingnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.436
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000