CVSS 4.0
7.0 highCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-53842
High (7.0) in openclaw openclaw. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in openclaw 2026.5.2.
OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.
Severity
CVSS 3.1
7.1 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
- CWE
- CWE-426
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fq9j-vw4w-fr6v | npm | openclaw | <2026.5.2 | 2026.5.2 |