GitHub Advisoryadvisory · npm

GHSA-99qw-6mr3-36qr OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

HIGH Published 2026-03-13 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-32920
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-829
Reviewed
2026-03-13

Affected packages

• npm openclaw: < 2026.3.12 → fixed in 2026.3.12

Description

Summary OpenClaw automatically discovered and loaded plugins from `.openclaw/extensions/` inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory. Impact Opening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account. Affected versions `openclaw` `<= 2026.3.11` Patch Fixed in `openclaw` `2026.3.12`. Workspace plugin loading now requires explicit trusted state before execution. Users should update to `2026.3.12` or later and avoid running OpenClaw inside untrusted repositories on older releases.

Related

Alias · CVE (1)

  • CVE-2026-32920 OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification,… vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References