CVE-2026-28447: Openclaw Path Traversal Vulnerability

HIGH
Advisory Identifier: GHSA-qrq5-wjgg-rvqw
Share
CVSS 8.1
CWE-22
Published
Advisory Summary

CVE-2026-28447 is a HIGH (CVSS 8.1) path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Openclaw libraries in the npm ecosystem. The issue involves openclaw has a path traversal in plugin installation. Remediation is available by upgrading affected packages to version 2026.2.1.

CVE-2026-28447 at a Glance

CVE Identifier CVE-2026-28447
GHSA Identifier GHSA-qrq5-wjgg-rvqw
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product Openclaw
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-28447

To remediate this vulnerability, upgrade all affected Openclaw dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

openclaw fixed: 2026.2.1 
npm install openclaw@2026.2.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls openclaw

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-28447, inspect your project dependencies using npm:

npm ls openclaw

Analyze the terminal output to locate any version of Openclaw in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.2.1), your application is affected.

Note: The npm ls openclaw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Openclaw, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary OpenClaw's plugin installation path derivation could be abused by a malicious plugin `package.json` `name` to escape the intended extensions directory and write files to a parent directory. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `>= 2026.1.20, < 2026.2.1` - Fixed: `>= 2026.2.1` - Latest published as of 2026-02-14: `2026.2.13` (not affected) ### Details In affected versions, the plugin installer derives the on-disk install directory from the plugin manifest name without robust validation. Example (POSIX / macOS / Linux): - Manifest name: `@malicious/..` - `unscopedPackageName("@malicious/..")` yields `..` - The install directory becomes `path.join(extensionsDir, "..")`, which resolves to the parent of the extensions directory. This can cause plugin files to be written into the OpenClaw state directory (default `~/.openclaw/`) rather than a subdirectory of `~/.openclaw/extensions/`. Note: on Windows, affected versions also failed to sanitize backslashes (`\\`) in the derived directory name, which can enable deeper traversal via crafted `pluginId` strings. ### Impact This issue requires a user/operator to install untrusted plugin content (for example via `openclaw plugins install`). In many deployments, plugin installation is an operator-only action and may be performed on a separate machine; that operational separation significantly reduces exposure for the primary gateway/runtime host. On hosts where untrusted plugins are installed, this can lead to unintended file writes outside the extensions directory (potentially overwriting files under the OpenClaw state directory). On Windows, the traversal surface may extend further, within the privileges of the user running OpenClaw. ### Fix Fixed in `openclaw` `2026.2.1` by validating plugin IDs and ensuring the resolved install directory remains within the configured extensions base directory. ### Fix Commit(s) - d03eca8450dc493b198a88b105fd180895238e57 Thanks @logicx24 for reporting.

CVE-2026-28447 Affected Openclaw Versions

1 component(s)
Fixed Versions:
2026.2.1
Product / Package Ecosystem Affected Versions Fixed Version
openclaw
npm/openclaw
npm
≥ 2026.1.20
< 2026.2.1
2026.2.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw
NVD — CVE-2026-28447 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28447
Security Fix Commit FIX COMMIT
https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e5
Security Fix Commit FIX COMMIT
https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57
Openclaw Source Repository REPOSITORY
https://github.com/openclaw/openclaw
Openclaw Release RELEASE
https://github.com/openclaw/openclaw/releases/tag/v2026.2.1
www.vulncheck.com/advisories/openclaw... WEB
https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name

Frequently Asked Questions

What is CVE-2026-28447?
CVE-2026-28447 is a security vulnerability in Openclaw involving OpenClaw has a Path Traversal in Plugin Installation under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Openclaw versions are affected?
Affected versions include releases prior to 2026.2.1 across affected packages: openclaw.
What version fixes CVE-2026-28447?
Upgrading to 2026.2.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is openclaw affected?
Yes, openclaw is affected in releases prior to 2026.2.1. Upgrade your dependency to 2026.2.1 or later.
What is the CVSS score of CVE-2026-28447?
CVE-2026-28447 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
What CWE is associated with CVE-2026-28447?
CVE-2026-28447 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check npm dependencies for CVE-2026-28447?
Run the dependency tree command: 'npm ls openclaw'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qrq5-wjgg-rvqw",
  "modified" : "2026-03-10T22:22:38Z",
  "published" : "2026-02-17T21:39:24Z",
  "aliases" : [ "CVE-2026-28447" ],
  "summary" : "OpenClaw has a Path Traversal in Plugin Installation",
  "details" : "### Summary\n\nOpenClaw's plugin installation path derivation could be abused by a malicious plugin `package.json` `name` to escape the intended extensions directory and write files to a parent directory.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `>= 2026.1.20, < 2026.2.1`\n- Fixed: `>= 2026.2.1`\n- Latest published as of 2026-02-14: `2026.2.13` (not affected)\n\n### Details\n\nIn affected versions, the plugin installer derives the on-disk install directory from the plugin manifest name without robust validation.\n\nExample (POSIX / macOS / Linux):\n\n- Manifest name: `@malicious/..`\n- `unscopedPackageName(\"@malicious/..\")` yields `..`\n- The install directory becomes `path.join(extensionsDir, \"..\")`, which resolves to the parent of the extensions directory.\n\nThis can cause plugin files to be written into the OpenClaw state directory (default `~/.openclaw/`) rather than a subdirectory of `~/.openclaw/extensions/`.\n\nNote: on Windows, affected versions also failed to sanitize backslashes (`\\\\`) in the derived directory name, which can enable deeper traversal via crafted `pluginId` strings.\n\n### Impact\n\nThis issue requires a user/operator to install untrusted plugin content (for example via `openclaw plugins install`). In many deployments, plugin installation is an operator-only action and may be performed on a separate machine; that operational separation significantly reduces exposure for the primary gateway/runtime host.\n\nOn hosts where untrusted plugins are installed, this can lead to unintended file writes outside the extensions directory (potentially overwriting files under the OpenClaw state directory). On Windows, the traversal surface may extend further, within the privileges of the user running OpenClaw.\n\n### Fix\n\nFixed in `openclaw` `2026.2.1` by validating plugin IDs and ensuring the resolved install directory remains within the configured extensions base directory.\n\n### Fix Commit(s)\n\n- d03eca8450dc493b198a88b105fd180895238e57\n\nThanks @logicx24 for reporting.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "openclaw"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2026.1.20"
      }, {
        "fixed" : "2026.2.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28447"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openclaw/openclaw"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/releases/tag/v2026.2.1"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-17T21:39:24Z",
    "nvd_published_at" : "2026-03-05T22:16:16Z"
  }
}