VYPR
← All advisories
High severity7.1NVD Advisory· Published Jun 16, 2026· Updated Jun 16, 2026

CVE-2026-53846

CVE-2026-53846

Description

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.4.292026.4.29

Affected products

2
  • OpenClaw/Openclawinferred2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <2026.4.29

Patches

Vulnerability mechanics

References

4

News mentions

1