CVE-2026-53819
HIGHOpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override
Title source: cnaDescription
OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.
References (2)
Core 2
Core References
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/openclaw-arbitrary-homebrew-executable-execution-via-workspace-env-override
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-8wg3-5mcm-fjq8)
https://github.com/openclaw/openclaw/security/advisories/GHSA-8wg3-5mcm-fjq8
Scores
CVSS v3
8.8
EPSS
0.0030
EPSS Percentile
22.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-426
Status
published
Products (4)
npm/openclaw
0 - 2026.5.27npm
OpenClaw/OpenClaw
< 2026.5.27
openclaw/openclaw
< 2026.5.27
OpenClaw/OpenClaw
2026.5.27
Published
Jun 11, 2026
Tracked Since
Jun 12, 2026