Executive brief
OpenClaw is a JavaScript plugin framework used to bundle and manage trusted extensions. A workspace-level `.env` file can override the built-in list of trusted plugins, allowing an attacker with control over a workspace to load malicious plugins. This could lead to arbitrary code execution if a user loads a compromised workspace.
Technical details
The vulnerability is a configuration override issue (CWE-15, CWE-829) where the `OPENCLAW_BUNDLED_PLUGINS_DIR` environment variable can be overridden by a workspace `.env` file, bypassing the plugin trust root. The root cause is insufficient separation between bundled (trusted) and workspace-provided configuration sources. An attacker must control the workspace that a user loads, and the user must load the workspace for the exploit to succeed. Successful exploitation allows loading arbitrary plugins with the privileges of the OpenClaw process. The fix is available in version 2026.3.31 and later; versions through 2026.3.28 are vulnerable.
Affected products
- OpenClaw OpenClaw <=2026.3.28
Timeline
- 2026-03-31: disclosed: Fix commit published
- 2026-04-03: advisory: GHSA-qcj9-wwgw-6gm8 published
- 2026-03-31: patched: Version 2026.3.31 released with fix