VYPR
← All advisories
High severity7.1NVD Advisory· Published Jun 16, 2026· Updated Jun 18, 2026

CVE-2026-53846

CVE-2026-53846

Description

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.4.292026.4.29

Affected products

7
  • OpenClaw/Openclawinferred7 versions
    (expand)+ 6 more
    • (no CPE)
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.29
    • cpe:2.3:a:openclaw:openclaw:2026.4.29:beta1:*:*:*:node.js:*:*
    • cpe:2.3:a:openclaw:openclaw:2026.4.29:beta2:*:*:*:node.js:*:*
    • cpe:2.3:a:openclaw:openclaw:2026.4.29:beta3:*:*:*:node.js:*:*
    • cpe:2.3:a:openclaw:openclaw:2026.4.29:beta4:*:*:*:node.js:*:*
    • (no CPE)range: <2026.4.29

Patches

Vulnerability mechanics

References

4

News mentions

1