PT-2026-49775 · Openclaw · Openclaw

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53858

NVD

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2026-53858

Affected Products

Openclaw

References · 3

• https://github.com/openclaw/openclaw/security/advisories/GHSA-wc84-j36w-pw4x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53858 · Security Note
• https://vulncheck.com/advisories/openclaw-arbitrary-runtime-dependency-loading-via-state-directory-environment-variable · Note