Description
OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository and convincing a user to run OpenClaw commands from that directory.
CVSS 7.8EPSS 0.14400000000000002%Risque 0.79
Voir la source- Publication
- 2026-05-11 18:16:40
- Versions concernées
- <2026.4.23
- Type
- Core software
- Vecteur
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H