OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
Summary
OpenClaw's bundled plugin setup resolver could fall back to process.cwd() while resolving provider setup metadata. If a user ran an OpenClaw command from an attacker-controlled repository containing extensions/<plugin>/setup-api.js, OpenClaw could load and execute that JavaScript during ordinary provider/model status resolution.
Impact
This is arbitrary JavaScript execution in the OpenClaw process under the current user account. A malicious repository could run code when the user executed commands such as provider/model inspection from that directory. The issue does not require gateway network exposure, but it does require user interaction: the user must run OpenClaw from a directory containing the attacker-controlled setup file.
Affected Packages / Versions
- Package:
openclawon npm - Affected: versions before
2026.4.23 - Fixed:
2026.4.23 - Latest stable verified fixed:
openclaw@2026.4.23, tagv2026.4.23
Fix
OpenClaw now resolves bundled setup fallbacks only from the canonical package/repository root and no longer includes process.cwd() as a trusted setup-api search root. A regression test verifies that a workspace-local extensions/<plugin>/setup-api.js is not loaded through provider setup resolution.
Fix Commit(s)
993781e6e6eaf50f033cfc3e3bf4f47059740707(fix(plugins): ignore cwd setup-api fallback)
Severity
Severity remains high because successful exploitation allows arbitrary code execution under the user running OpenClaw. The CVSS vector is local/user-interaction scoped rather than network-only because the victim must run OpenClaw from an attacker-controlled directory.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | openclaw | < 2026.4.23 | 2026.4.23 |
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-r39h-4c2p-3jxp
- https://nvd.nist.gov/vuln/detail/CVE-2026-45004
- https://github.com/openclaw/openclaw/commit/993781e6e6eaf50f033cfc3e3bf4f47059740707
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-setup-api-js-in-current-working-directory
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-94- Platform
- npm
- Package
openclaw- Disclosed
- 05.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-r39h-4c2p-3jxp - CC BY 4.0
Vulnerability history: openclaw
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 589
- First → latest
- 02.2026 10.2026
- Without a fix
- 9
- Exploited in attacks
- 0
Severity breakdown
- Critical 20
- High 215
- Medium 300
- Low 54
Disclosures per year
- 2026: 589
-
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.