●PocketClawAI security alerts
Sign in
highCVSS 8.1NVD status: Analyzed

CVE-2026-28447

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory.

ComponentOpenClaw
Severityhigh (CVSS 8.1)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Published (NVD)2026-03-05
Last modified2026-06-17
Affected versions
openclaw >= 2026.1.29, < 2026.2.1
Fixed in2026.2.1
WeaknessCWE-22
CISA KEVnot listed

NVD description

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensions directory. Attackers can craft scoped package names containing path traversal sequences like .. to write files outside the intended installation directory when victims run the plugins install command.

Does CVE-2026-28447 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for OpenClaw.
Check my stack

What to do

  • Upgrade OpenClaw to 2026.2.1 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other OpenClaw CVEs

medium
CVE-2026-108757CVSS 6.5

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips...

OpenClaw
2026-10-11high
CVE-2026-101884CVSS 7.5

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*,...

OpenClaw
2026-09-30high
CVE-2026-101880CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShe...

OpenClaw
2026-09-30medium
CVE-2026-101881CVSS 6.5

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport th...

OpenClaw
2026-09-30medium
CVE-2026-101883CVSS 5.4

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses U...

OpenClaw
2026-09-30high
CVE-2026-101882CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-exec...

OpenClaw
2026-09-30

All OpenClaw CVEs