High severity7.2NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026
CVE-2026-28456
CVE-2026-28456
Description
OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import(), allowing code execution. An attacker with gateway configuration modification access can load and execute unintended local modules in the Node.js process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | >= 2026.1.5, < 2026.2.14 | 2026.2.14 |
Affected products
3Patches
Vulnerability mechanics
References
7- github.com/openclaw/openclaw/commit/35c0e66ed057f1a9f7ad2515fdcef516bd6584cenvdPatchWEB
- github.com/openclaw/openclaw/commit/a0361b8ba959e8506dc79d638b6e6a00d12887e4nvdPatchWEB
- github.com/advisories/GHSA-v6c6-vqqg-w888ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-v6c6-vqqg-w888nvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-28456ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-unsafe-hook-module-path-handlingnvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/releases/tag/v2026.2.14ghsaWEB
News mentions
0No linked articles in our index yet.