Openclaw cli: OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading (CVE-2026-28393)

OpenClaw's hook mapping transform module path resolution did not properly restrict module paths, allowing absolute paths and '..' traversal sequences. This permitted configuration-controlled loading and execution of arbitrary JavaScript modules during webhook processing. An attacker able to modify the hooks configuration could exploit this to execute code with the gateway process's privileges. The issue affects versions >=2026.1.29 and <2026.2.14. The fix enforces that transform modules must reside within the designated transforms root directory (~/.openclaw/hooks/transforms), rejecting absolute paths outside this root and any path traversal attempts.

An attacker with the ability to write or modify the OpenClaw hooks configuration can cause the gateway process to load and execute arbitrary JavaScript code with its privileges. This could lead to unauthorized code execution within the gateway environment, potentially compromising the system or data handled by the gateway. The vulnerability does not require user interaction but does require configuration modification privileges.

A patch is available and should be applied by upgrading OpenClaw CLI to version 2026.2.14 or later. The fix restricts transform module loading to the designated transforms directory and rejects path traversal or absolute paths outside this root. Users should ensure only trusted parties can modify hooks configuration to prevent exploitation.