Arbitrary Code Execution Vulnerability in OpenClaw by OpenClaw

CVE-2026-45004

What is CVE-2026-45004?

OpenClaw versions prior to 2026.4.23 contain a vulnerability that allows attackers to execute arbitrary JavaScript code. This occurs through the bundled plugin setup resolver, which erroneously loads the setup-api.js file from the current working directory. If an attacker places a malicious setup-api.js file in a user’s repository and persuades them to execute OpenClaw commands from that location, they can run arbitrary code under the user’s account. This poses a significant risk to the integrity of systems utilizing OpenClaw, highlighting the importance of security patches and code execution controls.

References