Which versions of OpenClaw are affected by EUVD-2026-37144?

OpenClaw before version 2026.5.2 allows arbitrary Python runtime execution through malicious .env file manipulation during Gmail setup; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-37144?

Within 24 hours: Identify all OpenClaw installations and document versions currently in use. Within 7 days: Implement compensating controls including restrictive file permissions on .env files, disable Gmail setup features if operationally unnecessary, and enable logging for .env modifications. Within 30 days: Monitor for OpenClaw 2026.5.2 availability and execute a controlled upgrade plan across all instances.

OpenClaw EUVD-2026-37144

Q: What is the CVSS score of EUVD-2026-37144?

EUVD-2026-37144 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-53842 HIGH

Untrusted Search Path (CWE-426)

2026-06-16 VulnCheck

GHSA-9fr2-p65v-gqxq

GHSA-fq9j-vw4w-fr6v

Python RCE Openclaw

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.0 MEDIUM

Local vector (AV:L) because .env and runtime are host-side; AC:H and PR:L reflect required workspace write access; UI:R for operator-triggered Gmail setup; C/I:H for code execution, A:N as availability is not the primary impact.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:56 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.2.

DescriptionCVE.org

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

Articles & Coverage 1

News 6 New Python Vulnerabilities - 2 Critical, 4 High Severity Jun 17, 2026

AnalysisAI

Arbitrary Python runtime execution in OpenClaw before 2026.5.2 lets an attacker with write access to the workspace plant a malicious .env file that overrides the CLOUDSDK_PYTHON variable used during Gmail setup, redirecting gcloud invocations to an attacker-controlled Python interpreter and leading to code execution. The CVSS 4.0 vector (AV:L/AT:P/UI:A) confirms the attack is local, requires a specific attack condition, and depends on a user/operator action - no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

OpenClaw is the affected product per CPE cpe:2.3:a:openclaw:openclaw. The flaw maps to CWE-426 (Untrusted Search Path): instead of resolving the Python runtime from a trusted, hard-coded path, the Gmail setup flow honors CLOUDSDK_PYTHON - an environment variable the gcloud CLI uses to choose its Python interpreter. Because OpenClaw loads workspace-level .env files into the process environment before invoking gcloud, an attacker who can drop or modify a .env file inside the repository can point CLOUDSDK_PYTHON at any binary or script on disk, which gcloud will then execute as the Python runtime. This is a classic untrusted search/runtime resolution problem layered on top of an environment-variable trust boundary failure between the workspace and the host shell.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.2 or later, per the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-fq9j-vw4w-fr6v and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-arbitrary-python-runtime-execution-via-cloudsdk-python-environment-variable. Until upgrade is possible, restrict who can write to OpenClaw workspaces and to repository .env files (treat them as code, not config), and explicitly unset or pin CLOUDSDK_PYTHON in the shell environment used to launch OpenClaw so workspace overrides cannot redirect the gcloud Python runtime - the trade-off is that operators lose the ability to legitimately swap Python interpreters per project. As a defense-in-depth measure, run OpenClaw under a least-privileged account so that any code executed via a hijacked CLOUDSDK_PYTHON has limited access to credentials and host resources, accepting that this does not prevent execution itself.