VulnSocial

CVE-2026-28393Patch(openclaw / openclaw)

LOWCVSS 9.8 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch openclaw openclaw systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.

openclaw CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
openclaw
Products
openclaw

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-07: 3Patch / Workaround · 2026-03-07: 2Technical Details · 2026-03-07: 303-07
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets1 URL
By indicator
Full discourse3 posts
  • Renan Santos@renandnzsantos
    Patch

    O que isso muda para devs BR: • Frameworks de agentes IA têm superfície de ataque enorme — processam URLs arbitrárias, executam shells, recebem inputs de Slack/Discord/webhooks • CVE-2026-28393 é o mais crítico: path traversal em hook modules → execução arbitrária de JavaScript • A 2026.2.21 corrige tudo — update imediato se você opera em produção • Para qualquer framework de agentes: security review não é opcional, é infraestrutura

    Post summary

    The post alerts developers to the critical CVE‑2026‑28393 path traversal flaw in AI agent frameworks, explains that version 2026.2.21 contains the fix, and urges immediate patching and security reviews.

    0000027
    40 followersView on X
  • Renan Santos@renandnzsantos
    Patch

    The vulnerabilities (all patched in 2026.2.21): • CVE-2026-28393: Path traversal in hook transform module loading → arbitrary JavaScript execution • CVE-2026-28392: Privilege escalation in Slack slash-command handler → any DM sender could escalate • CVE-2026-28391: cmd.exe metacharacter injection in allowlist-gated exec requests • CVE-2026-28394: DoS in web_fetch tool via memory exhaustion

    Post summary

    The text announces that all listed CVEs have been patched as of version 2026.2.21, providing brief technical details for each vulnerability.

    0000014
    40 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-28393 OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. T… https://www.cve.org/CVERecord?id=CVE-2026-28393

    Post summary

    The tweet announces new CVE-2026-28393, describing a path traversal flaw in OpenClaw that permits arbitrary JavaScript code execution, but offers no PoC, exploit code, or mitigation details.

    00000175
    56.6K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-
Appopenclawopenclaw2.0.0node.js-
Appopenclawopenclaw2.0.0node.js-
Appopenclawopenclaw2.0.0node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities