{"id":"GHSA-qp5j-jr73-m2pw","title":"Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install","summary":"Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install","severity":"high","cvss":7.1,"cwe":["CWE-426"],"vendor":"openclaw","product":"openclaw","ecosystem":"npm","affected":["openclaw < 2026.4.29"],"published":"2026-06-16","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-qp5j-jr73-m2pw","references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53846"},{"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-package-manager-execution-via-workspace-env-npm-execpath"},{"url":"https://github.com/advisories/GHSA-qp5j-jr73-m2pw"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-29T14:31:47.499Z","slug":"GHSA-qp5j-jr73-m2pw","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-24vr-rprv-67rf. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.\n\n## Affected packages\n\n- `openclaw < 2026.4.29`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}