vulnerability · openclaw
OpenClaw workspace configuration could alter dependency setup
A workspace environment file could influence executable selection during bundled dependency setup. Exposure depends on a trusted operator opening the workspace and lower-trust configuration reaching that feature.
high severityhigh confidencepatchedNo known exploitation
Quick answer
What defenders need to know
- What is it?
- A workspace environment file could influence executable selection during bundled dependency setup. Exposure depends on a trusted operator opening the workspace and lower-trust configuration reaching that feature.
- Who is affected?
- openclaw < 2026.4.29
- What should defenders do?
- Upgrade OpenClaw to 2026.4.29 or later.
- Is a fix available?
- Yes. Upgrade to 2026.4.29.
01 / Response
What to do
- Upgrade OpenClaw to 2026.4.29 or later.
- Until patched, install bundled runtime dependencies only from trusted workspaces. Disable the affected feature if it is not needed.
02 / Technical assessment
Evidence-backed analysis
This is a workspace trust-boundary issue in dependency setup, not evidence of a malicious package or an MCP vulnerability. The advisory does not establish unauthenticated remote access or observed exploitation.
- A workspace environment file could influence executable selection during bundled dependency setup. Exposure depends on a trusted operator opening the workspace and lower-trust configuration reaching that feature.
03 / Timeline
Disclosure timeline
- GitHub Advisory Database publication
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
04 / Standards crosswalk
Standards crosswalk
No standards mappings are published for this record.
05 / Primary sources