CVE-2026-41360
OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding
CVSS Score
6.7
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. Attackers can replace approved local scripts before execution without invalidating the approval plan, allowing execution of modified script contents.
| CWE | CWE-367 |
| Vendor | openclaw |
| Product | openclaw |
| Published | Apr 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new medium vulnerabilities affecting openclaw openclaw are published โ delivered to Slack, Telegram or Discord.
Get Free Alerts โ
Free ยท No credit card ยท 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
OpenClaw / OpenClaw
0 < 2026.4.2
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-w6wx-jq6j-6mcj github.com: https://github.com/openclaw/openclaw/commit/176c059b05357df1bc09d4328a2380670859eeff vulncheck.com: https://www.vulncheck.com/advisories/openclaw-approval-integrity-bypass-in-pnpm-dlx-local-script-binding
Credits
๐ ้ฃ้ดๆ ๅท (@Kazamayc)