{"id":"EUVD-2026-37148","enisaUuid":"3284864d-22bb-3e2b-968b-7ee4a228cbc9","description":"OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.","datePublished":"Jun 16, 2026, 6:04:57 PM","dateUpdated":"Jun 18, 2026, 2:24:09 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf\nhttps://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath\n","aliases":"CVE-2026-53846\nGHSA-qp5j-jr73-m2pw\nGHSA-24vr-rprv-67rf\n","assigner":"VulnCheck","epss":0.12,"enisaIdProduct":[{"id":"0b40d26f-3f76-39c8-a552-1394e25625d9","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.29"}],"enisaIdVendor":[{"id":"70139128-801b-389d-ba97-bf775a15ca45","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"121eb9b2-0686-355b-969d-12e4203a07c2","vulnerability":{"id":"GHSA-24vr-rprv-67rf","description":"OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install","datePublished":"Jun 18, 2026, 8:33:54 PM","dateUpdated":"Jun 18, 2026, 8:33:54 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53846\nhttps://github.com/openclaw/openclaw\nhttps://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath\n","enisa_id":"EUVD-2026-37148\n","aliases":"GHSA-24vr-rprv-67rf\nCVE-2026-53846\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"3422f222-1e69-3788-a09b-2f0ec98c4d7b","vulnerability":{"id":"CVE-2026-53846","description":"OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.","datePublished":"Jun 16, 2026, 6:04:57 PM","dateUpdated":"Jun 18, 2026, 2:24:09 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf\nhttps://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath\n","enisa_id":"EUVD-2026-37148\n","assigner":"VulnCheck","epss":0.12,"dataProcessed":"Nov 7, 2026, 7:20:34 AM","vulnerabilityProduct":[{"id":"6f83f339-2614-35a3-a766-af47d9612003","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.4.29"}],"vulnerabilityVendor":[{"id":"39284a1e-ad3a-315a-b9ed-e3167f646d8a","vendor":{"name":"OpenClaw"}}]}},{"id":"9eb5404c-732d-35cd-b3c0-1df38a8af8a3","vulnerability":{"id":"GHSA-qp5j-jr73-m2pw","description":"Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install","datePublished":"Jun 16, 2026, 9:31:58 PM","dateUpdated":"Jun 18, 2026, 8:33:45 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53846\nhttps://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath\n","enisa_id":"EUVD-2026-37148\n","aliases":"GHSA-qp5j-jr73-m2pw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}