High severityNVD Advisory· Published Mar 5, 2026· Updated Mar 9, 2026
OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling
CVE-2026-28456
Description
OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import(), allowing code execution. An attacker with gateway configuration modification access can load and execute unintended local modules in the Node.js process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | >= 2026.1.5, < 2026.2.14 | 2026.2.14 |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/openclaw/openclaw/commit/35c0e66ed057f1a9f7ad2515fdcef516bd6584ceghsapatchWEB
- github.com/openclaw/openclaw/commit/a0361b8ba959e8506dc79d638b6e6a00d12887e4ghsapatchWEB
- github.com/advisories/GHSA-v6c6-vqqg-w888ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-v6c6-vqqg-w888ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-28456ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-unsafe-hook-module-path-handlingghsathird-party-advisoryWEB
- github.com/openclaw/openclaw/releases/tag/v2026.2.14ghsaWEB
News mentions
0No linked articles in our index yet.