Duplicate Advisory: Workspace-derived service PATH could influence trash command selection

GHSA-2w22-3f6x-3hf4

Published Jun 16, 2026 · Modified Jun 18, 2026

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rx78-29qr-5hq8. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.

References

WEB https://github.com/openclaw/openclaw/security/advisories/GHSA-rx78-29qr-5hq8
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53865
PACKAGE https://github.com/openclaw/openclaw
WEB https://www.vulncheck.com/advisories/openclaw-arbitrary-command-execution-via-workspace-derived-service-path

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes