OpenClaw CVE-2026-53865

Exploitation requires local access to an OpenClaw instance prior to 2026.5.2 with the ability to influence workspace-derived environment paths consumed by the maintenance task - typically authoring or modifying a workspace whose environment configuration is read when maintenance/trash operations execute. The attacker must additionally be able to drop an executable file into a directory that ends up earlier in the resolved service path than the legitimate trash binary, and a maintenance task must subsequently run. Exploitation is limited by: PR:L (the attacker needs an existing low-privileged account on the host or platform running OpenClaw), AV:L (no remote network vector), and AT:P (the deployment must actually let workspace-controlled paths feed the maintenance command lookup - single-user installs that do not expose workspace environment editing to other principals are not realistically exploitable).

The CVSS 4.0 vector AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N indicates a local attack requiring low privileges and a present attack requirement (a specific workspace/path configuration must be reachable), with high confidentiality and integrity impact but no availability impact - consistent with arbitrary command execution rather than denial of service. There is no EPSS score, KEV listing, or public POC in the supplied data, so real-world exploitation pressure is currently low, but VulnCheck dedicating an advisory and the GHSA assignment indicate a credible, reproducible issue rather than a theoretical one. The attack requirement (AT:P) and PR:L meaningfully constrain mass exploitation: this is a priority for multi-tenant or shared-workspace OpenClaw deployments where untrusted users can shape the workspace environment, and a lower priority for single-operator installs.

A low-privileged local user with access to an OpenClaw workspace plants a malicious executable named like the trash command in a directory that will be prepended to the service path derived from that workspace. When an operator (or scheduled job) runs a maintenance task, OpenClaw resolves the trash command through the poisoned path and executes the attacker's binary with the privileges of the maintenance process, yielding arbitrary code execution. No public exploit identified at time of analysis, but the path-poisoning pattern is well understood and trivially reproducible once workspace influence over PATH is confirmed.