CVE-2026-53819
HIGHOpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override
Title source: cnaDescription
OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
patch
GitHub Security Advisory (GHSA-8wg3-5mcm-fjq8)
https://github.com/openclaw/openclaw/security/advisories/GHSA-8wg3-5mcm-fjq8
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/openclaw-arbitrary-homebrew-executable-execution-via-workspace-env-override
Scores
CVSS v3
8.8
EPSS
0.0030
EPSS Percentile
21.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-426
Status
published
Products (3)
OpenClaw/OpenClaw
< 2026.5.27
openclaw/openclaw
< 2026.5.27
OpenClaw/OpenClaw
2026.5.27
Published
Jun 11, 2026
Tracked Since
Jun 12, 2026