CVE-2026-53864 Details

A vulnerability exists in OpenClaw versions prior to 2026.5.26, where the host environment sanitizer fails to properly sanitize certain Node.js control variables. This flaw allows these variables to bypass validation, potentially leading to unauthorized influence over child processes or coverage output paths. The vulnerability can be exploited by attackers with access to workspace .env files, tool environment overrides, or skill environment blocks.

Users are advised to avoid inheriting environment values from untrusted sources until the patch is applied. As a general hardening measure, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when not needed.