OpenClaw 2.0.0-beta3 < 2026.2.14 - 通过 Hook 转换路径遍历加载任意 JavaScript 模块

该路径遍历漏洞存在于 OpenClaw 的钩子转换模块加载过程中。攻击者可以通过操纵 hooks.mappings[].transform.module 参数，该参数允许指定模块路径，利用绝对路径和路径遍历序列，加载并执行恶意 JavaScript 模块。由于钩子模块通常以具有 gateway 进程特权的身份运行，因此成功利用此漏洞可能导致攻击者完全控制 OpenClaw 实例，并可能进一步影响其底层系统。攻击者可以利用此漏洞窃取敏感数据、篡改系统配置或执行其他恶意操作。

Organizations and individuals using OpenClaw, particularly those with publicly accessible instances or those who allow external users to modify configuration files, are at risk. Environments where OpenClaw is integrated with other systems or services are also at increased risk due to the potential for lateral movement.

• javascript: Examine OpenClaw configuration files for suspicious entries in the hooks.mappings[].transform.module parameter, particularly those containing absolute paths or traversal sequences (e.g., ../). • javascript: Monitor OpenClaw logs for errors or warnings related to module loading failures, which could indicate an attempted exploitation. • javascript: Use a debugger to step through the hook transform module loading process and identify any unexpected file access patterns.

1. 2026-03-05Disclosure

   disclosure

1. 已保留2026-02-27
2. 发布日期2026-03-05
3. 修改日期2026-03-11
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即将 OpenClaw 升级至 2026.2.14 或更高版本。如果无法立即升级，可以考虑限制对钩子配置文件的写入访问权限，仅允许受信任的用户或进程进行修改。此外，实施严格的输入验证，以防止攻击者注入恶意路径。监控 OpenClaw 日志，查找任何异常模块加载或执行行为。如果无法升级，请审查钩子配置，确保没有可利用的路径遍历。