Openclaw CVE-2026-32978

Requires OpenClaw before version 2026.3.11 with script runners tsx or jiti enabled. Authenticated user with approval privileges must click malicious link or be socially engineered to approve a benign script command. Attacker then rewrites the referenced script file on disk before execution.

The CVSS 4.0 vector indicates network-accessible attack (AV:N) with low complexity (AC:L) requiring low privileges (PR:L) and user interaction (UI:P), resulting in critical 9.4 severity with high impact across all CIA dimensions. The authentication requirement (PR:L) and mandatory user interaction (UI:P) provide some natural barriers - attackers must hold valid low-privilege credentials and socially engineer approval from authorized users. However, the low attack complexity and network vector enable remote exploitation once these conditions are met. Without EPSS data or KEV listing for this future-dated CVE (2026), exploitation probability cannot be quantified through predictive modeling. The availability of detailed vendor advisories (GHSA-qc36-x95h-7j53 and VulnCheck write-up) provides attackers with implementation details, increasing weaponization risk. The TOCTOU nature makes this potentially automatable once initial access and approval are obtained. Real-world risk is HIGH for organizations using OpenClaw with tsx/jiti runners in production, particularly in environments where approval workflows are routinely granted or where attackers have established low-privilege foothold access.

A remote attacker with low-privilege OpenClaw credentials crafts a benign JavaScript utility script and submits it for system.run approval through the organization's workflow. Once an administrator approves the seemingly harmless script execution via the UI, the attacker immediately overwrites the script file on disk with malicious payload code (reverse shell, credential stealer, or lateral movement tool) exploiting the window between approval grant and actual execution by the tsx or jiti runner. Because the approval system fails to bind the file's content or hash at authorization time, the execution engine runs the modified malicious script under the approved context, granting the attacker elevated execution privileges and potentially full system compromise depending on the run context's permissions.