VYPR
← All advisories
High severity8.1NVD Advisory· Published Jun 16, 2026· Updated Jun 16, 2026

CVE-2026-53864

CVE-2026-53864

Description

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openclawnpm
< 2026.5.262026.5.26

Affected products

2
  • OpenClaw/Openclawinferred2 versions
    <2026.5.26+ 1 more
    • (no CPE)range: <2026.5.26
    • (no CPE)range: <2026.5.26

Patches

Vulnerability mechanics

References

4

News mentions

1