PT-2026-49759 · Openclaw · Openclaw

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53842

NVD

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2026-53842

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-fq9j-vw4w-fr6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53842 · Security Note
• https://vulncheck.com/advisories/openclaw-arbitrary-python-runtime-execution-via-cloudsdk-python-environment-variable · Note