CVE-2026-28393: Openclaw

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.

Affected products

• Openclaw Openclaw: from 2026.1.4, before 2026.2.14 (fixed in 2026.2.14); version 2.0.0 only

Published 2026-03-05. Last modified 2026-06-17.