Path Traversal Vulnerability in OpenClaw: Impact on Dependency Installation
Summary
GHSA-qp5j-jr73-m2pw: Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package management tool designed to facilitate the installation and management of JavaScript packages. It allows developers to create and manage their workspace environments efficiently. However, a vulnerability has been identified in versions prior to 2026.4.29, which can lead to security risks during the installation of bundled runtime dependencies.
Vulnerability Detail
The vulnerability arises from a path traversal issue in the install helper of OpenClaw. This flaw allows workspace .env files to override the npm_execpath configuration, which is critical for determining the executable path for package managers. Attackers with access to the workspace can exploit this vulnerability to execute unintended local package-manager executables during the dependency setup process. This could compromise the build environment, leading to potential unauthorized access or manipulation of the application.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, update OpenClaw to version 2026.4.29 or later. You can do this by running the following command in your terminal: npm install openclaw@2026.4.29. This will ensure that you are using a version of the package that has patched the vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your workspace does not contain any malicious .env files that could override the npm_execpath configuration. Regularly audit your workspace for any unauthorized changes.
Conclusion
The path traversal vulnerability in OpenClaw poses significant risks to the security of applications using this package. It is crucial to update to the latest version to mitigate these risks. Regular monitoring and auditing of your workspace can further enhance security.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
All versions of OpenClaw prior to 2026.4.29 are affected by this vulnerability.
If exploited, this vulnerability could allow attackers to execute unauthorized commands, potentially compromising the integrity and security of your application.
Yes, you can mitigate the risk by ensuring that your workspace does not contain any malicious .env files and by regularly auditing your dependencies.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.