Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing path traversal sequences like .. to write files outside the intended installation directory when victims run the plugins install command.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28447 OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escap… https://www.cve.org/CVERecord?id=CVE-2026-28447
Post summary
The text announces the newly disclosed CVE-2026-28447 path traversal flaw in certain OpenClaw versions, but it lacks evidence of exploitation, PoC, or patch information.
🟠 CVE-2026-28447 - High OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions director... https://www.thehackerwire.com/vulnerability/CVE-2026-28447/ https://t.co/YNFpSREknU
Post summary
The post announces a path‑traversal vulnerability in OpenClaw (CVE‑2026‑28447) that allows malicious plugin package names to escape the extensions directory, affecting versions prior to 2026.2.1.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |