PT-2026-39693 · Openclaw · Openclaw

Mirr2 · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-45004

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.23

Description An arbitrary code execution issue exists in the bundled plugin setup resolver. During provider setup metadata resolution, the system loads setup-api.js from process.cwd(). An attacker can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository and convincing a user to run OpenClaw commands from that directory.

Recommendations Update to version 2026.4.23 or later.

Exploit

Fix

Uncontrolled Search Path Element

Code Injection

Weakness Enumeration

CWE-427

CWE-94

Related Identifiers

CVE-2026-45004

GHSA-R39H-4C2P-3JXP

GHSA-XPR6-2HGM-4WWP

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45004.json · Exploit
• https://github.com/openclaw/openclaw/commit/993781e6e6eaf50f033cfc3e3bf4f47059740707 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r39h-4c2p-3jxp · Vendor Advisory
• https://vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-setup-api-js-in-current-working-directory · Patch
• https://osv.dev/vulnerability/CVE-2026-45004 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r39h-4c2p-3jxp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xpr6-2hgm-4wwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45004 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://t.me/CVEtracker/53390 · Telegram Post
• https://twitter.com/CVEnew/status/2053932430185390524 · Twitter Post