CVE-2026-28393: Path Traversal in OpenClaw

The path traversal vulnerability in OpenClaw's hook transform module loading allows for arbitrary JavaScript execution. An attacker who can modify the hooks.mappings[].transform.module parameter can specify absolute paths or traversal sequences to load and execute malicious modules. This effectively grants the attacker gateway process privileges, potentially enabling them to compromise the entire system. The impact is significant due to the potential for remote code execution and privilege escalation within the OpenClaw environment. Successful exploitation could lead to data theft, system disruption, or further malicious activity.

1. Reserved2026-02-27
2. Published2026-03-05
3. Modified2026-03-11
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-28393 is to immediately upgrade OpenClaw to version 2026.2.14 or later. Prior to upgrading, it's crucial to back up your OpenClaw configuration files to facilitate a rollback if the upgrade introduces unforeseen issues. If upgrading is not immediately feasible, restrict write access to the hook configuration files to only authorized personnel. Implement input validation on the hooks.mappings[].transform.module parameter to prevent the inclusion of absolute paths or traversal sequences. Monitor system logs for suspicious activity related to module loading and JavaScript execution.