Arbitrary JavaScript Module Loading Vulnerability in OpenClaw
Summary
GHSA-7xhj-55q9-pc3m: OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading. Affects openclaw versions >= 2.0.0-beta3, < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source framework designed for building webhooks and integrating various services through a modular architecture. It allows developers to define hooks and transformations to process incoming requests. However, a critical vulnerability exists in its hook transform module path handling, which can lead to unauthorized code execution.
Vulnerability Detail
The vulnerability arises from the way OpenClaw handles the paths for hook mapping transforms. Specifically, the hooks.mappings[].transform.module can be manipulated to load arbitrary JavaScript modules by using absolute paths or directory traversal techniques (e.g., ..). This flaw allows an attacker with the ability to modify the hooks configuration to execute malicious code within the gateway process, potentially leading to severe security breaches.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the hooks.transformsDir is set correctly within the OpenClaw configuration and avoid using absolute paths or .. traversal in the transform.module settings. Regularly review and restrict access to the configuration files to prevent unauthorized modifications.
Conclusion
The OpenClaw framework has a vulnerability that allows for arbitrary JavaScript module loading through improper path handling in hook transforms. It is crucial to update to version 2026.2.14 or later to mitigate this risk. Regular monitoring and configuration management are essential to maintain security.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 6.0, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's vulnerability status using the Vulert playground at Vulert Scanner without any signup.
If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the gateway process, potentially leading to data breaches or service disruptions.
While the best solution is to update to the patched version, you can mitigate the risk by restricting access to configuration files and ensuring that transform paths do not use absolute paths or directory traversal.
The vulnerability was reported by a user identified as @akhmittra, contributing to the security of the OpenClaw project.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
