PT-2026-27289 · Npm · Openclaw

Publicado 2026-03-13 · Atualizado 2026-03-13

OSV

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

OpenClaw automatically discovered and loaded plugins from .openclaw/extensions/ inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory.

Impact

Opening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account.

Affected versions

openclaw <= 2026.3.11

Patch

Fixed in openclaw 2026.3.12. Workspace plugin loading now requires explicit trusted state before execution. Users should update to 2026.3.12 or later and avoid running OpenClaw inside untrusted repositories on older releases.

Correção

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

GHSA-99QW-6MR3-36QR

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12 · Nota
• https://vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-auto-discovery-of-workspace-plugins · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32920 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-99qw-6mr3-36qr · Aviso do Fabricante