GHSA-v8cx-933x-r976: OpenClaw: Fake package roots could influence memory-core artifact loading
OpenClaw versions prior to 2026.4.25 have a vulnerability where fake package roots can influence memory-core artifact loading. This occurs when a local package root resolution path, influenced by workspace state, selects a package root other than the intended bundled artifact root. The vulnerability affects the named feature and configuration but does not alter the trusted-operator model of OpenClaw. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is patched starting from version 2026.4.25. Until patched, it is recommended to run memory-core flows from trusted workspaces and apply general hardening measures such as narrowing allowlists and disabling the affected feature when not needed.
AI Analysis
Technical Summary
This vulnerability in OpenClaw allows a local package root resolution path, influenced by workspace state, to select a fake package root instead of the intended bundled artifact root. This can cause memory-core artifacts to be loaded from unintended local locations. The vulnerability is scoped to a specific feature and configuration and does not affect the trusted-operator model, meaning authenticated Gateway operators and installed plugins remain trusted unless other security boundaries are crossed. The vulnerability is identified as CWE-427 and has a high severity rating. It affects OpenClaw versions prior to 2026.4.25, which is the first stable patched version.
Potential Impact
When the affected feature is enabled and reachable, memory-core artifacts could be loaded from unintended local locations. The practical impact depends on the operator's configuration and whether lower-trust input can influence the package root resolution path. This could potentially lead to loading untrusted or malicious artifacts, impacting the integrity of the system's memory-core operations.
Mitigation Recommendations
A fix is available in OpenClaw version 2026.4.25 and later. Until systems are updated, it is recommended to run memory-core flows only from trusted workspaces. Additionally, narrow channel and tool allowlists, avoid sharing a Gateway between mutually untrusted users, and disable the affected feature when it is not needed to reduce risk.
GHSA-v8cx-933x-r976: OpenClaw: Fake package roots could influence memory-core artifact loading
Description
OpenClaw versions prior to 2026.4.25 have a vulnerability where fake package roots can influence memory-core artifact loading. This occurs when a local package root resolution path, influenced by workspace state, selects a package root other than the intended bundled artifact root. The vulnerability affects the named feature and configuration but does not alter the trusted-operator model of OpenClaw. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path. The issue is patched starting from version 2026.4.25. Until patched, it is recommended to run memory-core flows from trusted workspaces and apply general hardening measures such as narrowing allowlists and disabling the affected feature when not needed.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in OpenClaw allows a local package root resolution path, influenced by workspace state, to select a fake package root instead of the intended bundled artifact root. This can cause memory-core artifacts to be loaded from unintended local locations. The vulnerability is scoped to a specific feature and configuration and does not affect the trusted-operator model, meaning authenticated Gateway operators and installed plugins remain trusted unless other security boundaries are crossed. The vulnerability is identified as CWE-427 and has a high severity rating. It affects OpenClaw versions prior to 2026.4.25, which is the first stable patched version.
Potential Impact
When the affected feature is enabled and reachable, memory-core artifacts could be loaded from unintended local locations. The practical impact depends on the operator's configuration and whether lower-trust input can influence the package root resolution path. This could potentially lead to loading untrusted or malicious artifacts, impacting the integrity of the system's memory-core operations.
Mitigation Recommendations
A fix is available in OpenClaw version 2026.4.25 and later. Until systems are updated, it is recommended to run memory-core flows only from trusted workspaces. Additionally, narrow channel and tool allowlists, avoid sharing a Gateway between mutually untrusted users, and disable the affected feature when it is not needed to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v8cx-933x-r976
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53813"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a46ecc927e9c7971943edbc
Added to database: 07/02/2026, 22:57:13 UTC
Last enriched: 07/02/2026, 23:19:50 UTC
Last updated: 07/03/2026, 03:37:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.