PT-2026-48740 · Openclaw · Openclaw
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.5.18
Description
An issue exists where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, which allows them to bypass security scanning and achieve arbitrary code execution.
Recommendations
Update to version 2026.5.18.
Exploit
Fix
Code Injection
Improper Access Control
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw