CVE-2026-53858: OpenClaw Environment Variable Injection and Code Execution Vulnerability

Technical summary

CVE-2026-53858 is an environment variable injection vulnerability (CWE-426) in OpenClaw's dependency resolution mechanism. The STATE_DIRECTORY environment variable, configurable via workspace .env files, is used to determine the root path for bundled runtime dependencies. Insufficient validation of this variable allows local attackers to redirect dependency loading to arbitrary paths. When OpenClaw resolves dependencies during build or import operations, it may load malicious libraries from attacker-controlled directories, achieving code execution in the context of the OpenClaw process. The vulnerability requires user interaction (opening a malicious workspace) and local system access but does not require elevated privileges.

Business impact

This vulnerability poses a significant supply-chain and insider-threat risk for development teams. A developer who opens a crafted OpenClaw workspace (delivered via shared repository, email, or collaborative platform) can have arbitrary code injected into their build pipeline without elevated permissions. The impact extends beyond a single machine if compromised binaries are committed to version control or published as artifacts. Organizations relying on OpenClaw for build automation or dependency management should assume that compromised workspaces could inject malware into development, staging, or production artifacts, potentially affecting customers and downstream consumers.

Affected systems

OpenClaw versions prior to 2026.5.2 are affected. This includes all 2026.5.x releases before 2026.5.2 and any earlier major versions. The vulnerability requires a local account and workspace access, so risk is highest in environments where developers clone or use repositories from untrusted or insufficiently vetted sources. Shared development machines, CI/CD agents running OpenClaw, and cloud development environments are particularly at risk.

Exploitability

Exploitability is moderately high for local attackers with the ability to influence workspace configuration. The attack does not require code execution to begin with, only file write access to a .env file within a project directory—a capability available to any user with commit access to a repository or the ability to deliver files to a target system. The user interaction requirement (opening or building the workspace) is a practical constraint but not a strong barrier in development workflows where developers routinely build projects received from peers or repositories. No authentication or network access is required, and the attacker does not need to modify the OpenClaw binary itself.

Remediation

Upgrade OpenClaw to version 2026.5.2 or later. Users unable to upgrade immediately should restrict write access to workspace .env files and review repository history for suspicious modifications to STATE_DIRECTORY or related environment variables. Additionally, validate the source and integrity of OpenClaw workspaces before opening or building them, and run builds in isolated or containerized environments where possible to limit the blast radius of potential code injection.

Patch guidance

Apply the available patch by upgrading to OpenClaw 2026.5.2 or later as soon as feasible. Verify the patch version in your installation by checking the application version string or consulting the vendor's release notes. If you are running OpenClaw in a CI/CD pipeline, update the base image or package dependency specification to 2026.5.2 or later and redeploy all agents. For development teams, communicate the update requirement to all team members and ensure that shared development machines and containers are patched before resuming work on untrusted or external projects.

Detection guidance

Monitor for unusual STATE_DIRECTORY environment variable values in OpenClaw process execution contexts. Check workspace .env files for STATE_DIRECTORY entries that point to unexpected directories (e.g., /tmp, user-writable paths outside the project directory, or network-accessible shares). Review build logs for failures or warnings during dependency resolution that may indicate missing or malicious libraries. On Windows systems, look for attempts to read from unusual UNC paths; on Unix systems, monitor for access to world-writable directories during dependency loading. Correlate OpenClaw process spawns with subsequent child process creation to identify potential code execution artifacts.

Why prioritize this

This vulnerability merits high-priority remediation due to the combination of high CVSS score (7.1), local code execution potential, and the critical role of build and dependency systems in the software supply chain. While exploitation requires user interaction and local access, the barrier to entry is low for anyone with repository access. The lack of KEV designation does not diminish the risk; this is a newly published vulnerability affecting a development tool with no current known public exploit, but the attack surface is broad in collaborative development environments.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects a local attack vector with low complexity, no privilege escalation, user interaction required, and high impact to confidentiality and integrity. The score appropriately captures the severity for development contexts where local access is common and user interaction (opening a project) is routine. The absence of availability impact acknowledges that the vulnerability does not directly cause denial of service, though compromised builds could be unavailable or unreliable downstream.

Frequently asked questions