Which versions of OpenClaw are affected by EUVD-2026-37148?

OpenClaw prior to version 2026.4.29 allows build environment hijacking through local .env file manipulation, enabling insiders or collaborators with workspace access to redirect package installations…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-37148?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37148. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-37148?

24 hours: Inventory all projects using OpenClaw versions prior to 2026.4.29; implement file system ACLs to restrict .env file creation in development workspaces. 7 days: Deploy file integrity monitoring on workspace .env files and npm process execution logging; audit developer and CI/CD system access to workspace directories. 30 days: Apply OpenClaw version 2026.4.29+ as soon as vendor patch releases and completes internal testing.

OpenClaw EUVD-2026-37148

Q: What is the CVSS score of EUVD-2026-37148?

EUVD-2026-37148 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-53846 HIGH

Untrusted Search Path (CWE-426)

2026-06-16 VulnCheck

GHSA-24vr-rprv-67rf

GHSA-qp5j-jr73-m2pw

Path Traversal Openclaw

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Local workspace access plus a victim-run install (AV:L, UI:R); AC:H for the attack-requirement of a writable workspace and present package-manager target; PR:N since the attacker needs no OpenClaw auth; high C/I, no availability impact.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:55 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.29.

DescriptionCVE.org

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

AnalysisAI

Untrusted search path in OpenClaw versions prior to 2026.4.29 lets workspace-local .env files override the npm_execpath variable consulted by the install helper, redirecting bundled dependency installation to an attacker-controlled package-manager binary. An attacker who can place files in the workspace can hijack the runtime dependency setup step to compromise the build environment under the developer's identity, with no public exploit identified at time of analysis.

Technical ContextAI

OpenClaw is a JavaScript/Node-based project that uses an install helper to fetch bundled runtime dependencies via the package manager indicated by the npm_execpath environment variable (a standard npm/Yarn convention pointing to the package-manager executable invoked for child scripts). Per CWE-426 (Untrusted Search Path), the helper resolves the executable path from environment input read out of project-local .env files, so a malicious value placed in a workspace .env can point npm_execpath at any binary on the local filesystem. Combined with path traversal in how the helper loads .env, this lets a relative path escape the expected workspace directory and reach an arbitrary executable, which the helper then runs as the package-installation tool. The single affected CPE, cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covers all OpenClaw versions before 2026.4.29.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.4.29 or later, which is the fixed release identified in GHSA-24vr-rprv-67rf (https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath). Until the upgrade is applied, do not run OpenClaw install/setup steps against untrusted workspaces or repositories, delete or audit any unexpected .env files at the workspace root before invoking dependency installation, and explicitly unset or pin npm_execpath in the shell environment used to run installs so a workspace .env cannot override the resolved package-manager path (side effect: build scripts that rely on the calling package manager being auto-detected may need an explicit --npm/--yarn flag). For CI, restrict who can push .env files and run installs inside ephemeral, isolated runners so a hijacked package-manager binary cannot persist or reach long-lived secrets.