p PatchFirst

CVE-2026-53842

CVE-2026-53842 · OpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment Variable

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

CVSS 7.0 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.5.2: Affected (semver)
    • 2026.5.2: Not affected (semver)

    Update to 2026.5.2

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.5.2

    Update to 2026.5.2

Original sources

Check your server →