Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-28393
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal
OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.
References
-
GitHub Security Advisory (GHSA-7xhj-55q9-pc3m) vendor-advisory
-
Patch Commit #1 patch
-
Patch Commit #2 patch
Affected products
OpenClaw
- <2026.2.14
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>