CVE-2026-28393

CVE-2026-28393 · OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.

CVSS 8.3 · High · EPSS 0.5% · Fix available

Published

2026-03-05T21:59:22.003Z

Updated

2026-03-11T13:33:46.364Z

Stack: node

Check your server →