CVE-2026-53819: OpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-11 · updated 2026-06-17
Weakness: CWE-426

Description

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

Affected products

OpenClaw: before 2026.5.27 — fixed in 2026.5.27

How to fix

Upgrade to a fixed version: OpenClaw 2026.5.27. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-8wg3-5mcm-fjq8
https://www.vulncheck.com/advisories/openclaw-arbitrary-homebrew-executable-execution-via-workspace-env-override

Get alerted when CVE-2026-53819 or the next vulnerability affects your stack