CVE-2026-53819: OpenClaw Package Vulnerability Allows .env Override of Homebrew Executable
Summary
CVE-2026-53819: OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows. Affects openclaw versions < 2026.5.27. Fixed in 2026.5.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed to facilitate the installation and management of skills in various environments. It leverages Homebrew, a popular package manager for macOS, to streamline the installation process. However, a vulnerability exists that allows a workspace's .env file to override the selection of the Homebrew executable, potentially leading to unintended consequences during skill installation.
Vulnerability Detail
The vulnerability arises from the ability of a workspace's .env file to override the Homebrew executable used during skill installation flows. This could allow an attacker to execute unintended Homebrew-compatible executables if the affected feature is enabled and accessible. The risk is particularly pronounced if lower-trust input can reach the installation path, potentially leading to unauthorized code execution. The vulnerability is classified under CWE-426, indicating a potential issue with untrusted search path.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5.27
This is the first release that contains the fix.
npm install openclaw@2026.5.27Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid running skill installation flows from untrusted workspaces until the patch is applied. Additionally, consider narrowing your channel and tool allowlists, avoid sharing a Gateway between untrusted users, and disable the affected feature when it is not needed.
Conclusion
In summary, CVE-2026-53819 is a significant vulnerability in the OpenClaw package that allows for the potential override of the Homebrew executable selection through a workspace's .env file. It is crucial to update to the patched version 2026.5.27 to mitigate this risk and ensure secure skill installation flows.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows a workspace's .env file to override the Homebrew executable selection, which could lead to unintended code execution during skill installations.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update immediately, avoid running skill install flows from untrusted workspaces and consider disabling the affected feature until a patch is applied.
The patch addresses the vulnerability by preventing the .env file from overriding the Homebrew executable selection during skill installation flows.
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
