CVE-2026-53846: OpenClaw Path Traversal in npm_execpath Configuration

Technical summary

CVE-2026-53846 is a path traversal vulnerability (CWE-426) in OpenClaw's install helper that fails to properly validate workspace .env file configuration. The flaw allows untrusted .env files to override the npm_execpath parameter, which controls which package manager executable is invoked during bundled runtime dependency installation. An unauthenticated local attacker can exploit this to substitute their own malicious package manager and gain arbitrary code execution in the build environment context. The vulnerability requires user interaction (installation trigger) but no privilege escalation.

Business impact

Build environments are a high-value attack target. Successful exploitation allows attackers to poison dependencies before they reach production, potentially affecting every downstream user of the compromised software. This creates supply chain risk at the point of package generation. Organizations using OpenClaw in CI/CD pipelines or shared development workspaces face heightened risk of silent compromise, where malicious code is injected into released packages without detection.

Affected systems

OpenClaw versions prior to 2026.4.29 are affected. Specific version ranges and affected distributions should be verified against the vendor advisory. The vulnerability impacts any installation using the affected install helper with workspace-based dependency management.

Exploitability

Exploitation is straightforward but requires local workspace access. An attacker must place a crafted .env file in the workspace, then trigger an installation event (e.g., by committing code or manually running dependency setup). The CVSS score of 7.1 reflects this: local attack vector with no privilege requirements but requiring user interaction to complete the installation process. This makes it practical for insider threats or compromised development accounts.

Remediation

Update OpenClaw to version 2026.4.29 or later. The fix implements proper validation of .env file configuration and prevents workspace files from overriding critical npm_execpath settings. Organizations should prioritize patching development and CI/CD environments where dependency installation occurs.

Patch guidance

Apply the 2026.4.29 release or later. Before patching, audit recent builds generated with affected versions to identify potential supply chain contamination. Verify patch completeness by confirming that .env files no longer override npm_execpath in your installation logs. Consider running builds in isolated containers to limit blast radius during the patching window.

Detection guidance

Monitor for suspicious .env files in workspaces containing npm_execpath overrides that point to non-standard executables. Check installation logs for unexpected package manager invocations. Implement code review policies that flag changes to .env files in build-critical directories. Compare actual package manager binaries executed during builds against expected paths. In CI/CD pipelines, enforce environment variable immutability to reject workspace overrides.

Why prioritize this

This vulnerability sits at the intersection of low exploitation friction and high business impact. Build environment compromise is difficult to detect but compromises all downstream artifacts. The presence in development workflows alongside the ability to execute arbitrary code during installation makes this a tier-one concern for security teams managing shared development infrastructure or publishing packages.

Risk score, explained

The CVSS 7.1 (HIGH) rating reflects the high integrity and confidentiality impact combined with local attack vector and low complexity. The lack of privileges required and presence of user interaction (triggering installation) are balanced against the fact that this affects only local code execution rather than system-wide impact. For supply chain contexts, the business risk significantly exceeds the numeric score.

Frequently asked questions