PT-2026-49781 · Openclaw · Openclaw

Chinmohan Nayak · Publicado 2026-06-16 · Atualizado 2026-06-16 · CVE-2026-53864

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2026-53864

Produtos afetados

Openclaw

Referências · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-ccwh-wwpp-6wg5 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-insufficient-environment-variable-sanitization-in-node-js-control-variables · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53864 · Nota de Segurança