PT-2026-23522 · Openclaw · Openclaw

Akhmittra · Published 2026-03-03 · Updated 2026-03-11 · CVE-2026-28393

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2.0.0-beta3 through 2026.2.13

Description The OpenClaw software contains a path traversal issue within the hook transform module loading process that could lead to arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter is susceptible to accepting absolute paths and traversal sequences. An attacker with configuration write access can leverage this to load and execute malicious modules with gateway process privileges. The issue arises because path resolution previously accepted absolute paths and did not enforce containment for relative paths, allowing a config-controlled transform to resolve outside the intended transforms directory.

Recommendations Update OpenClaw to version 2026.2.14 or later.

Fix

Uncontrolled Search Path Element

Path traversal

Weakness Enumeration

CWE-427

CWE-22

Related Identifiers

CVE-2026-28393

GHSA-7XHJ-55Q9-PC3M

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/a0361b8ba959e8506dc79d638b6e6a00d12887e4 · Patch
• https://github.com/openclaw/openclaw/commit/18e8bd68c5015a894f999c6d5e6e32468965bfb5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-7xhj-55q9-pc3m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28393 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28393 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xhj-55q9-pc3m · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/155040 · Telegram Post
• https://twitter.com/CVEnew/status/2030385199284883755 · Twitter Post
• https://vulncheck.com/advisories/openclaw-beta-arbitrary-javascript-module-loading-via-hook-transform-path-traversal · Note
• https://twitter.com/renandnzsantos/status/2030385569650380904 · Twitter Post