πŸ” CVE Alert

CVE-2026-53858

HIGH 7.1

OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable

CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

CWE CWE-426
Vendor openclaw
Product openclaw
Published Jun 16, 2026
Last Updated Jun 16, 2026
Stay Ahead of the Next One

Get instant alerts for openclaw openclaw

Be the first to know when new high vulnerabilities affecting openclaw openclaw are published β€” delivered to Slack, Telegram or Discord.

Get Free Alerts β†’ Free Β· No credit card Β· 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected Versions

OpenClaw / OpenClaw
0 < 2026.5.2

References

NVD β†— CVE.org β†— EPSS Data β†—
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-wc84-j36w-pw4x vulncheck.com: https://www.vulncheck.com/advisories/openclaw-arbitrary-runtime-dependency-loading-via-state-directory-environment-variable

Credits

πŸ” 侯桷飞 (@feynman-hou)