Executive brief
OpenClaw is a development tool that loads plugin setup metadata during routine operations like checking provider status. The vulnerability allows arbitrary code execution if a user runs OpenClaw commands from a directory containing a malicious setup-api.js file—for example, when cloning an attacker's repository and running OpenClaw within it. An attacker can execute any code under the user's account without additional network access or special privileges.
Technical details
This is an unsafe code loading vulnerability (CWE-94, CWE-427) in OpenClaw's bundled plugin setup resolver. During provider setup metadata resolution, the resolver incorrectly includes process.cwd() as a trusted search path for setup-api.js, allowing it to load and execute attacker-controlled JavaScript from extensions/<plugin>/setup-api.js in the current working directory. The attack requires the victim to run OpenClaw commands from an attacker-controlled directory (e.g., a malicious repository), but no special privileges or network access are required. Successful exploitation results in arbitrary JavaScript execution under the user running OpenClaw. The fix (version 2026.4.23 and later) removes process.cwd() from the trusted setup-api search roots and restricts lookups to the canonical package/repository root.
Affected products
- OpenClaw OpenClaw before 2026.4.23
Timeline
- 2026-04-24: disclosed: Original advisory GHSA-r39h-4c2p-3jxp published
- 2026-04-24: patched: Fix released in version 2026.4.23
- 2026-05-11: other: Duplicate advisory GHSA-xpr6-2hgm-4wwp published
- 2026-05-18: other: GHSA-xpr6-2hgm-4wwp withdrawn as duplicate