Vulnerabilities

TI-2026-38842 CVE-2026-53846 · GHSA-24vr-rprv-67rf

OpenClaw < 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm_execpath

LOW 32

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation.

CVSS 4.0HIGH 7.0 Local No auth User interaction EPSS 0.00118 Published 2026-06-16 Fixed in 2026.4.29 CWE-426

TI-2026-38840 CVE-2026-53844 · GHSA-72fw-cqh5-f324

OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search

LOW 26

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0021 Published 2026-06-16 Fixed in 2026.4.29 CWE-862

Vulnerabilities

Filters

OpenClaw < 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm_execpath

OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search