CVE-2026-45004: OpenClaw arbitrary code execution in plugin setup resolver

Executive brief

OpenClaw, a tool for managing AI providers and models, is vulnerable to a security flaw that allows it to execute malicious code from the current working directory. If a user runs an OpenClaw command within a folder containing a specially crafted file provided by an attacker, the attacker can gain full control over the user's account and data. This could lead to the theft of sensitive information or unauthorized access to connected AI services.

Technical details

OpenClaw's bundled plugin setup resolver incorrectly falls back to searching the current working directory (`process.cwd()`) for setup metadata. An attacker can place a malicious `extensions/<plugin>/setup-api.js` file in a repository; if a user executes OpenClaw commands (like provider or model inspection) from that directory, the malicious JavaScript is loaded and executed. This is a code injection vulnerability (CWE-94) that occurs during environment key resolution. The issue is fixed in version 2026.4.23 by restricting setup resolution to the canonical package root.

Affected products

• openclaw openclaw < 2026.4.23

Timeline

• 2026-04-24: patched: Fix committed to repository
• 2026-05-05: advisory: GitHub Advisory published

References

• https://api.github.com/users/Mirr2
• https://github.com/Mirr2
• https://api.github.com/users/Mirr2/gists%7B/gist_id%7D
• https://api.github.com/users/Mirr2/repos
• https://avatars.githubusercontent.com/u/130574746?v=4
• https://api.github.com/users/Mirr2/events%7B/privacy%7D