Openclaw cli: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution (CVE-2026-45004)

OpenClaw's plugin setup resolver previously included process.cwd() as a fallback location for resolving provider setup metadata. If a user ran OpenClaw from a directory controlled by an attacker containing extensions/<plugin>/setup-api.js, OpenClaw would load and execute that JavaScript code. This results in arbitrary code execution within the OpenClaw process under the current user account. The vulnerability is local and requires user interaction, as the user must run OpenClaw from the attacker-controlled directory. The issue is fixed in version 2026.4.23 by removing process.cwd() from the trusted setup-api search roots and limiting resolution to the canonical package root.

Successful exploitation allows an attacker to execute arbitrary JavaScript code with the privileges of the user running OpenClaw. This can lead to full compromise of the user's environment where OpenClaw is executed. The attack requires the user to run OpenClaw commands from a directory containing the malicious setup-api.js file, so it is limited to local or social engineering scenarios. There is no network vector for exploitation.

A fix is available in OpenClaw version 2026.4.23. Users should upgrade to this version or later to prevent arbitrary code execution via malicious setup-api.js files in the current working directory. The fix removes process.cwd() from the setup resolution fallback paths, ensuring only the canonical package root is trusted. No additional mitigation steps are required once the update is applied.