CVE-2026-41360CWE-367

OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding

Medium · published April 23, 2026

CVSS v4.0
5.4
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. Attackers can replace approved local scripts before execution without invalidating the approval plan, allowing execution of modified script contents.

The record
Technical detail
CVSS v4.0
5.4 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00122 · 1.8th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-04-23T21:58Z
EPSS history
Timeline
  • 23 APR 21:58Z
    OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding
    cvelistv5