Which versions of OpenClaw are affected by EUVD-2026-37160?

OpenClaw versions prior to 2026.5.2 expose development teams to arbitrary code execution through malicious workspace configuration files.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-37160?

Yes, a public proof-of-concept exploit is available for EUVD-2026-37160. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-37160?

Within 24 hours: Inventory all systems running OpenClaw versions before 2026.5.2; audit .env file write access and recent modifications in development repositories. Within 7 days: Restrict .env file write permissions to authorized developers, implement mandatory code review for .env changes, and document workspace provenance requirements. Within 30 days: Monitor for OpenClaw 2026.5.2 release; deploy immediately upon availability with mandatory upgrade enforcement.

OpenClaw EUVD-2026-37160

Q: What is the CVSS score of EUVD-2026-37160?

EUVD-2026-37160 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-53858 HIGH

Untrusted Search Path (CWE-426)

2026-06-16 VulnCheck

GHSA-4qgr-57jq-93vh

GHSA-wc84-j36w-pw4x

Code Injection Openclaw

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.6 MEDIUM

Local workspace-trust flaw: attacker needs ability to write a .env in the victim's workspace (PR:L) and the victim must open it (UI:R); resulting code execution yields high C/I but no availability impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 20:02 EUVD

Analysis Generated

Jun 16, 2026 - 18:51 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.2.

DescriptionCVE.org

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

AnalysisAI

Untrusted search path in OpenClaw before 2026.5.2 allows local attackers who can influence a workspace .env file to redirect bundled runtime dependency loading to attacker-controlled paths, resulting in arbitrary code execution during dependency resolution. The STATE_DIRECTORY environment variable is not validated before being used to anchor runtime dependency roots, so a poisoned workspace can execute code in the context of a user who opens it. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

OpenClaw is an open-source workspace/runtime tool that resolves bundled runtime dependencies relative to a state directory configured via the STATE_DIRECTORY environment variable, which can be supplied by a project's workspace .env file. The flaw maps to CWE-426 (Untrusted Search Path): because the runtime trusts a value loaded from in-workspace configuration, an attacker who controls that .env can point dependency lookup at arbitrary local paths containing malicious modules. The single CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* indicates the upstream OpenClaw application itself across all versions prior to 2026.5.2 is in scope, with no separate vendor distribution split.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.2 or later, which constrains how STATE_DIRECTORY is resolved for bundled runtime dependencies, per the GHSA at https://github.com/openclaw/openclaw/security/advisories/GHSA-wc84-j36w-pw4x. Until the upgrade can be applied, treat workspace .env files as untrusted input: do not open OpenClaw workspaces obtained from third parties, strip or override STATE_DIRECTORY from .env loading (accepting that projects relying on a custom state directory will break), and run OpenClaw under a least-privileged user account so any code executed during dependency resolution is contained. On shared developer or CI hosts, consider blocking write access to repository .env files from unprivileged automation and reviewing recently modified .env files for unexpected STATE_DIRECTORY entries; the trade-off is added friction for legitimate per-project configuration overrides.