Openclaw cli: OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install (CVE-2026-53846)

The vulnerability (CVE-2026-53846) in openclaw-cli arises because a workspace .env file can override the npm_execpath environment variable, influencing which package-manager executable is used during bundled runtime dependency installation. This can lead to execution of an unintended local package-manager binary when a trusted operator opens a repository containing such a .env file. The vulnerability does not alter the trusted-operator security model but can be exploited if lower-trust input reaches the affected feature. The first stable patched version is 2026.4.29, and affected versions are >=2026.1.29 and <2026.4.29.

If exploited, this vulnerability could allow an attacker to cause the execution of an unintended local package-manager executable during dependency setup, potentially leading to compromise of the operator's environment or execution of malicious code. The actual impact depends on the operator's configuration and whether untrusted input can influence the npm_execpath environment variable in the workspace .env file.

A patch is available in openclaw-cli version 2026.4.29. Until patched, users should install bundled runtime dependencies only from trusted workspaces. Additional mitigations include keeping channel and tool allowlists narrow, avoiding sharing a Gateway between mutually untrusted users, and disabling the affected feature when it is not needed.