Which versions of OpenClaw are affected by CVE-2026-45004?

OpenClaw versions before 2026.4.23 contain an arbitrary code execution vulnerability allowing attackers to inject malicious JavaScript that executes when users run OpenClaw commands from…. A patch is available.

How to fix or mitigate CVE-2026-45004?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.4.23 and restrict usage until patched. Within 7 days: Deploy OpenClaw version 2026.4.23 or later across all affected developer environments and CI/CD systems. Within 30 days: Audit execution logs for OpenClaw invocations from suspicious directories and review developer machine activity logs for unauthorized code execution during the exposure period.

OpenClaw CVE-2026-45004

Q: What is the CVSS score of CVE-2026-45004?

CVE-2026-45004 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29149 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-05-11 VulnCheck

GHSA-xpr6-2hgm-4wwp

GHSA-r39h-4c2p-3jxp

RCE Openclaw

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

May 11, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

May 11, 2026 - 18:22 NVD

7.8 (HIGH) 8.4 (HIGH)

Source Code Evidence Fetched

May 11, 2026 - 17:46 vuln.today

Analysis Generated

May 11, 2026 - 17:46 vuln.today

CVE Published

May 11, 2026 - 16:46 nvd

HIGH 7.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.23.

DescriptionCVE.org

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository and convincing a user to run OpenClaw commands from that directory.

AnalysisAI

Arbitrary code execution in OpenClaw via CWD-based setup-api.js injection allows local attackers to run malicious JavaScript when users execute OpenClaw commands from attacker-controlled directories. Affects all OpenClaw versions before 2026.4.23. Vendor-released patch available in version 2026.4.23. Exploitation requires user interaction (running OpenClaw commands from a malicious repository) but no authentication. CVSS 7.8 reflects local attack vector with user interaction requirement, mitigating remote exploitation risk.

Technical ContextAI

This vulnerability stems from CWE-427 (Uncontrolled Search Path Element), where OpenClaw's plugin setup resolver incorrectly trusted process.cwd() as a search path for bundled setup-api.js modules during provider setup metadata resolution. When resolving provider configuration, the application would search for extensions/<plugin>/setup-api.js in multiple locations including the current working directory. Node.js module resolution combined with process.cwd() creates a DLL-hijacking-style attack where an attacker-controlled file takes precedence over legitimate bundled modules. The fix removes process.cwd() from the repoRootCandidates array, restricting setup-api resolution to only the canonical package root (CURRENT_MODULE_PATH ancestor), and adds regression testing to verify workspace-local setup-api.js files are ignored. This is a classic untrusted search path vulnerability affecting JavaScript/Node.js applications that dynamically load code based on runtime working directory.

RemediationAI

Upgrade to OpenClaw version 2026.4.23 or later, which removes process.cwd() from the setup-api search path and restricts module resolution to the canonical package root. The fix is available via npm (npm install openclaw@2026.4.23 or npm update openclaw) and documented in GitHub commit 993781e6e6eaf50f033cfc3e3bf4f47059740707 (https://github.com/openclaw/openclaw/commit/993781e6e6eaf50f033cfc3e3bf4f47059740707). If immediate patching is not possible, implement compensating controls: restrict OpenClaw execution to trusted directories only, use read-only mounts or filesystem permissions to prevent users from writing to directories where OpenClaw will be executed, and run OpenClaw in isolated containers or VMs when processing untrusted repositories. These workarounds reduce attack surface but introduce operational overhead (restricted developer workflows, container management complexity) and do not fully eliminate risk if users can still influence the working directory. Full vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-r39h-4c2p-3jxp and VulnCheck analysis at https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-setup-api-js-in-current-working-directory.