Environment Variable Injection Vulnerability in OpenClaw: Impact on Dependency Resolution
Summary
GHSA-4qgr-57jq-93vh: Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source project designed for building interactive applications using Node.js. It allows developers to manage various aspects of their applications through a workspace environment. However, it has been found to be vulnerable to an environment variable injection issue that can affect the integrity of its runtime dependency management.
Vulnerability Detail
The vulnerability arises from the manipulation of the STATE_DIRECTORY environment variable within the workspace .env file. Attackers can exploit this by altering the STATE_DIRECTORY to point to unintended local paths, which may lead to the loading of malicious runtime dependencies. This can result in the execution of arbitrary code during the dependency resolution process, posing a significant security risk to applications using OpenClaw.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, update OpenClaw to version 2026.5.2 or later. You can do this by running the following command in your terminal: 'npm install openclaw@latest'. This will ensure that you are using a version of the package that has addressed the vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that the STATE_DIRECTORY variable in your .env file is set to a secure and controlled path. Avoid using user-controlled input to set this variable, and validate any paths that are used.
Conclusion
The environment variable injection vulnerability in OpenClaw poses a significant risk by allowing attackers to manipulate dependency paths. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can allow attackers to execute malicious code, potentially compromising the security of the application and its data.
Yes, the vulnerability has been patched in version 2026.5.2 of OpenClaw. It is recommended to update to this version or later.
If an immediate update is not possible, ensure that the STATE_DIRECTORY variable is set to a secure path and avoid using untrusted input to define it.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.