Executive brief
OpenClaw is a developer workspace tool that automatically discovers and loads plugins from cloned repositories without explicit trust verification. An attacker can embed malicious plugins in a repository that execute arbitrary code with the user's privileges when the repository is opened in OpenClaw, leading to account compromise or data theft.
Technical details
OpenClaw automatically discovers and loads plugins from .openclaw/extensions/ directory without explicit trust verification, enabling an untrusted-control-sphere code execution vulnerability (CWE-829). An attacker can craft a malicious repository containing a workspace plugin in .openclaw/extensions/ that executes when a user clones and opens the repository in OpenClaw. The attack requires no authentication or network interaction beyond repository cloning; it triggers upon normal use of the product. An attacker gains arbitrary code execution under the user's account. The vulnerability was patched in version 2026.3.12, which now requires explicit trust verification before loading workspace plugins.
Affected products
- OpenClaw OpenClaw <=2026.3.11
Timeline
- 2026-03-13: disclosed
- 2026-03-12: patched: Version 2026.3.12 adds explicit trust verification for workspace plugins