A path traversal vulnerability in OpenClaw allows authenticated attackers with configuration write access to achieve arbitrary JavaScript execution with gateway process privileges.

This is a path traversal flaw (CWE-22) located in the hook transform module loading mechanism. Attackers with high-level configuration write privileges can manipulate the hooks.mappings[].transform.module parameter to load malicious JavaScript files, resulting in code execution within the gateway process.

The ability to execute arbitrary JavaScript with gateway process privileges poses a severe risk to the integrity and confidentiality of the application environment. An attacker could leverage this access to manipulate internal application logic, intercept sensitive data, or potentially pivot further into the underlying infrastructure. With a CVSS score of 7.7, this vulnerability represents a high-risk security gap that requires immediate remediation to prevent unauthorized system control.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later, as specified in the OSV advisory.

Proactive Monitoring: Review application configuration logs for anomalous entries in the hooks.mappings structure and monitor for unexpected module loading activity.

Compensating Controls: Restrict administrative access to configuration files and ensure that only trusted users possess the privileges required to modify application hooks.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the impact, organizations should prioritize the update to version 2026.2.14 immediately. Security teams must audit existing configurations to ensure no unauthorized hooks have been introduced during the period the software was vulnerable. Prompt patching is the only reliable method to eliminate the risk of arbitrary code execution associated with this path traversal flaw.