Threats affecting pkg:npm/openclaw

OpenClaw versions up to 2026.3.28 have a vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime scopes, potentially allowing elevated privileges within plugin routes. This issue is limited to plugin routes that interact with privileged runtime actions before plugin authentication completes. The vulnerability has been assigned CVE-2026-41394 and is rated high severity with a CVSS score of 8.2. A fix is available in version 2026.3.31 and later.

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent normalization of environment variables between approval and execution paths. This flaw allows attackers to inject environment variables that bypass the approval system, potentially influencing runtime behavior and enabling execution of attacker-controlled binaries. The vulnerability is fixed in commit b57b680.

OpenClaw versions prior to commit 8aceaf5 contain a vulnerability in the shell-bleed protection mechanism. This flaw allows attackers to bypass preflight validation by using piped or complex command forms that the parser does not recognize. As a result, attackers can execute arbitrary script content that would normally be blocked by the validateScriptFileForShellBleed() function. The issue is fixed in commit 8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513.

OpenClaw versions prior to 2026.3.22 contain a vulnerability in the host environment sanitization logic that fails to block certain package-manager and related environment variables. This flaw allows an attacker, upon an approved execution request, to redirect package resolution or runtime bootstrap processes to attacker-controlled infrastructure, potentially leading to execution of malicious code. The issue is fixed in version 2026.3.22.

A vulnerability in OpenClaw's gateway allows write-scoped callers to persist verbose output session overrides via the chat.send path, which should be restricted to admin-only access. This could lead to unintended exposure of detailed reasoning or tool output. The issue affects versions up to 2026.3.24 and is fixed in version 2026.3.28.

OpenClaw had a vulnerability where the host execution environment sanitization did not block the environment variables GIT_TEMPLATE_DIR and AWS_CONFIG_FILE. These variables can redirect trusted tools like git and AWS CLI to attacker-controlled configurations, potentially allowing execution of untrusted code or loading attacker-selected credentials. The issue affects OpenClaw versions up to 2026.3.24 and is fixed in version 2026.3.28.

A vulnerability in the OpenClaw Feishu extension allows bypassing the localRoots sandbox during file upload path resolution, enabling arbitrary file reads outside the sandbox. This affects versions from 2026.2.6 up to 2026.3.27. The issue is fixed in version 2026.3.28.

OpenClaw CLI's remote onboarding feature accepted discovered gateway endpoints without explicit user confirmation, persisting remote URLs and connection details. This flaw allowed a malicious or spoofed discovery endpoint to redirect onboarding to an attacker-controlled gateway, potentially capturing gateway credentials and traffic. The vulnerability affects versions up to 2026.3.24 and is fixed in version 2026.3.28.

OpenClaw versions before 2026.3.28 have a path traversal vulnerability in media parsing functions that allows attackers to bypass path validation and read arbitrary files outside the intended sandbox. This can lead to disclosure of sensitive files such as system files, environment files, and SSH keys. The vulnerability is fixed in version 2026.3.28.

OpenClaw versions before 2026.2.23 have a cross-site scripting (XSS) vulnerability in the HTML session exporter. This flaw allows attackers to inject malicious JavaScript by manipulating mimeType values in image content blocks. When exported HTML sessions are opened, the injected script can execute, leading to potential client-side code execution.

CVE-2026-32038 is a critical vulnerability in OpenClaw before version 2026.2.24 that allows trusted operators to bypass sandbox network isolation. By manipulating the docker.network parameter with container:<id> values, attackers can join another container's network namespace, circumventing network hardening controls.

OpenClaw versions before 2026.2.21 contain a vulnerability where dangerous process-control environment variables are not properly filtered from configuration environment variables. This flaw allows attackers to inject variables such as NODE_OPTIONS or LD_* during startup, enabling arbitrary code execution within the OpenClaw gateway service runtime context.