Skip to main content

OpenClaw EUVD-2026-27273

| CVE-2026-43531 HIGH
External Control of System or Configuration Setting (CWE-15)
2026-05-05 VulnCheck
Code Injection
7.0
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Updated
May 05, 2026 - 12:49 vuln.today
v2 (cvss_changed)
Re-analysis Queued
May 05, 2026 - 12:37 vuln.today
cvss_changed
CVSS changed
May 05, 2026 - 12:37 NVD
7.3 (HIGH) 7.0 (HIGH)
Source Code Evidence Fetched
May 05, 2026 - 12:19 vuln.today
Analysis Generated
May 05, 2026 - 12:19 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.9.

DescriptionNVD

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise application behavior.

AnalysisAI

Environment variable injection in OpenClaw npm package versions before 2026.4.9 allows local attackers with low privileges to compromise application behavior through malicious workspace .env files. Attackers can redirect update sources to serve backdoored packages, modify gateway URLs and ClawHub resolution endpoints to intercept traffic, and override browser executable paths to launch attacker-controlled binaries. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Inventory all projects and systems using OpenClaw npm package and verify installed versions. Within 7 days: Upgrade OpenClaw to version 2026.4.9 or later (2026.4.14 recommended) across all affected environments; validate upgrades in development/staging first. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

EUVD-2026-27273 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy