Executive brief
OpenClaw is a popular JavaScript build and module system library. During channel setup, the system could incorrectly load untrusted plugins from a user's workspace before checking the official bundled plugins, bypassing intended security controls. An attacker could exploit this to inject malicious code during the build/setup phase.
Technical details
The vulnerability is a plugin resolution bypass (CWE-829: Improper Restriction of Used-After-Free Attack and CWE-862: Missing Authorization) in OpenClaw's channel setup catalog lookups. During initialization, the system resolves workspace plugin shadows before checking trusted bundled channel plugins, allowing untrusted code execution without passing the intended trust gates. The attack requires network access and elevated privileges (authenticated user with project setup capability). An attacker can inject malicious plugins that execute during channel setup, potentially compromising the build environment and downstream artifacts. The fix routes catalog lookups through trusted paths and explicitly excludes workspace shadows where setup should not include them. Versions 2026.4.10 and later, including 2026.4.14, contain the fix.
Affected products
- OpenClaw OpenClaw < 2026.4.10
Timeline
- 2026-04-17: disclosed
- 2026-04-17: patched: Fix released in version 2026.4.10
- 2026-05-05: other: NVD published advisory