Executive Summary

CVE-2026-53846 is a path traversal vulnerability in OpenClaw versions before 2026.4.29. It occurs in the install helper component, where a workspace .env file can override the npm_execpath configuration. This configuration determines which package-manager executable is used during runtime dependency installation.

An attacker with access to the workspace can exploit this flaw to execute unintended local package-manager binaries during the dependency setup process, potentially compromising the build environment.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers who have workspace access to execute arbitrary local package-manager executables during dependency installation. This can lead to compromise of the build environment, potentially allowing malicious code execution or unauthorized actions within the build process.

The impact depends on the operator's configuration and whether untrusted input can influence the npm_execpath setting.

• Compromise of build environment integrity
• Execution of unintended or malicious package-manager binaries

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if your OpenClaw installation is a version prior to 2026.4.29 and if the affected feature that uses workspace .env files to override npm_execpath is enabled.

You can inspect workspace .env files for suspicious overrides of the npm_execpath configuration that might point to unintended local package-manager executables.

Commands to help detect potential exploitation or presence of the vulnerability include:

• Check OpenClaw version: `openclaw --version` or check package.json dependencies for OpenClaw version.
• Search for npm_execpath overrides in workspace .env files: `grep -r npm_execpath .`
• Audit running processes or logs during dependency installation for unexpected package-manager executions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading OpenClaw to version 2026.4.29 or later, which contains the patch for this vulnerability.

Until patched, only install bundled runtime dependencies from trusted workspaces to reduce risk.

• Keep channel and tool allowlists narrow to limit exposure.
• Avoid sharing Gateways between untrusted users to prevent unauthorized workspace access.
• Disable the feature that allows workspace .env files to override npm_execpath if it is not necessary.

Useful 0 Not Useful 0