CVE-2026-53864: OpenClaw Node.js Control Variables Exposure Vulnerability
Summary
CVE-2026-53864: OpenClaw: Host environment sanitizer missed two Node.js control variables. Affects openclaw versions < 2026.5.26. Fixed in 2026.5.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source framework designed for building and deploying applications in Node.js environments. It provides a range of features for developers, including environment management and plugin support. However, a recent vulnerability has been identified that affects how environment variables are sanitized, potentially allowing lower-trust sources to influence Node.js control variables.
Vulnerability Detail
The vulnerability arises from a failure in the host environment sanitizer to adequately filter two Node.js control variables. This oversight allows lower-trust environment sources, such as workspace .env files or tool environment overrides, to pass control variables through the sanitizer. If exploited, this could lead to unintended consequences, such as influencing the behavior of Node.js child processes or altering coverage output paths. The impact is contingent on the operator's configuration and the accessibility of lower-trust inputs.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.26
This is the first release that contains the fix.
npm install openclaw@2026.5.26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid inheriting environment values from untrusted repositories until the patch is applied. Additionally, maintain narrow channel and tool allowlists, refrain from sharing a single Gateway between untrusted users, and disable the affected feature when not in use.
Conclusion
In summary, CVE-2026-53864 presents a significant risk to applications using OpenClaw due to inadequate sanitization of Node.js control variables. It is crucial to update to the patched version 2026.5.26 and implement recommended workarounds to safeguard your application.
See every vulnerability recorded for openclaw →
FAQ
CVE-2026-53864 is a vulnerability in the OpenClaw framework that allows lower-trust environment sources to pass Node.js control variables through a sanitizer, potentially leading to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level that requires prompt attention.
If immediate updates are not possible, implement the suggested workarounds to mitigate risks until you can apply the patch.
The patch addresses the issue by ensuring that the host environment sanitizer properly filters Node.js control variables, preventing unauthorized access from lower-trust sources.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
