Executive Summary

CVE-2026-53858 is a vulnerability in OpenClaw versions before 2026.5.2 where the workspace .env file can manipulate the STATE_DIRECTORY environment variable. This variable influences the roots of bundled runtime dependencies.

Attackers can exploit this by changing the STATE_DIRECTORY to load runtime dependencies from unintended local paths. This can cause malicious code to be executed during the dependency resolution process.

The vulnerability arises from an untrusted search path issue, meaning that the software may load code from locations that are not properly verified or trusted.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to the execution of malicious code on your system during the runtime dependency loading phase.

The impact depends on your configuration and whether untrusted input can influence the STATE_DIRECTORY path. If an attacker can control this, they might load harmful dependencies from local paths.

This could compromise the integrity and security of your OpenClaw environment, potentially allowing unauthorized actions or code execution.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-53858 vulnerability in OpenClaw, you should upgrade to version 2026.5.2 or later, where the issue is patched.

Avoid opening untrusted workspace .env files before dependency installation to prevent manipulation of the STATE_DIRECTORY environment variable.

Disable the feature that allows the STATE_DIRECTORY environment variable to influence runtime dependency roots if it is not necessary in your environment.

Useful 0 Not Useful 0