CVE-2026-53864CWE-184

OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables

High · published June 16, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-06-16T18:05Z
EPSS history
Timeline
  • 16 JUN 18:05Z
    OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables
    cvelistv5