CVE-2026-53810
CVE-2026-53810 · OpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension Metadata
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, bypassing security scanning.
CVSS 7.7 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node