Executive brief
OpenClaw is a development tool that manages code dependencies and plugins. A vulnerability allows attackers to manipulate environment variables in workspace configuration files to force the tool to load malicious code from unintended locations during dependency installation. An attacker with local access to a development machine could execute arbitrary code with the privileges of the developer running OpenClaw.
Technical details
The vulnerability is an untrusted search path vulnerability (CWE-426) in OpenClaw's dependency resolution mechanism. The root cause is insufficient validation of the STATE_DIRECTORY environment variable read from workspace .env files before runtime dependency root resolution occurs. An attacker can craft a malicious .env file in a repository that, when opened by a developer, sets STATE_DIRECTORY to point to an attacker-controlled local path containing malicious dependencies. During the dependency resolution phase, OpenClaw loads these malicious dependencies instead of the legitimate ones. The attack requires local file system access and user interaction (opening the repository), but does not require authentication. The vulnerability is fixed in version 2026.5.2; mitigation includes avoiding opening untrusted workspace .env files before dependency installation and disabling the affected feature if not needed.
Affected products
- OpenClaw OpenClaw < 2026.5.2
Timeline
- 2026-05-28: disclosed: Original advisory GHSA-wc84-j36w-pw4x published
- 2026.5.2: patched: Patched version released
- 2026-06-16: other: Duplicate advisory GHSA-4qgr-57jq-93vh published and subsequently withdrawn