Insufficient Sanitization in OpenClaw's Node.js Environment

CVE-2026-53864

What is CVE-2026-53864?

OpenClaw versions prior to 2026.5.26 have a security issue due to insufficient sanitization of environment variables in the host environment. This vulnerability can be exploited by attackers who gain access to workspace .env files, tool environment overrides, or skill environment blocks. By passing malicious Node.js control variables through these means, attackers can manipulate child processes and coverage output paths, potentially compromising the integrity of the application.

References