https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 02:51:24 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28393 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>OpenClaw hook mapping transforms could be loaded via absolute paths or `..` traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration.</p> <p>## Affected Versions</p> <p>- Affected: &gt;= 2.0.0-beta3 and &lt;= 2026.2.13 - Fixed: 2026.2.14</p> <p>## Details</p> <p>`hooks.mappings[].transform.module` is dynamically imported and executed during webhook processing. Path resolution previously accepted absolute paths and did not enforce containment for relative paths, so a config-controlled transform could resolve outside the intended transforms directory.</p> <p>## Impact</p> <p>If an attacker can write the OpenClaw config (or otherwise update hooks config through authenticated configuration mechanisms), they could point a hook mapping transform at an arbitrary module on disk and execute code with the gateway process privileges.</p> <p>## Reproduction (config-controlled module load)</p> <p>1. Configure a hook mapping that points to a transform path that escapes the transforms directory (for example via `..` traversal). 2. Place a malicious ESM module at the resolved location that executes arbitrary code in the gateway process. 3. Trigger the hook endpoint with the correct hook token.</p> <p>## Fix</p> <p>Transform loading is now constrained to the OpenClaw transforms root directory:</p> <p>- Root: `~/.openclaw/hooks/transforms` - `hooks.transformsDir` must be within that directory - `transform.module` must be within the selected transforms directory</p> <p>Attempts t…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>OpenClaw hook mapping transforms could be loaded via absolute paths or `..` traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration.</p> <p>## Affected Versions</p> <p>- Affected: &gt;= 2.0.0-beta3 and &lt;= 2026.2.13 - Fixed: 2026.2.14</p> <p>## Details</p> <p>`hooks.mappings[].transform.module` is dynamically imported and executed during webhook processing. Path resolution previously accepted absolute paths and did not enforce containment for relative paths, so a config-controlled transform could resolve outside the intended transforms directory.</p> <p>## Impact</p> <p>If an attacker can write the OpenClaw config (or otherwise update hooks config through authenticated configuration mechanisms), they could point a hook mapping transform at an arbitrary module on disk and execute code with the gateway process privileges.</p> <p>## Reproduction (config-controlled module load)</p> <p>1. Configure a hook mapping that points to a transform path that escapes the transforms directory (for example via `..` traversal). 2. Place a malicious ESM module at the resolved location that executes arbitrary code in the gateway process. 3. Trigger the hook endpoint with the correct hook token.</p> <p>## Fix</p> <p>Transform loading is now constrained to the OpenClaw transforms root directory:</p> <p>- Root: `~/.openclaw/hooks/transforms` - `hooks.transformsDir` must be within that directory - `transform.module` must be within the selected transforms directory</p> <p>Attempts t…</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-28393 https://db.gcve.eu/vuln/cve-2026-28393 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.</p> https://db.gcve.eu/vuln/cve-2026-28393