Arbitrary OS Command Execution in OpenClaw Plugin by RTK-AI

CVE-2026-55249

What is CVE-2026-55249?

The OpenClaw plugin from RTK-AI, specifically in version 1.0.0, contains a vulnerability that allows attackers to execute arbitrary shell commands. This occurs because the plugin incorrectly handles user input when using the exec tool. The vulnerable process directly inserts attacker-controlled input into a shell command without proper escaping, allowing malicious commands to be executed. By influencing the command parameter of the exec tool, an attacker can execute commands with the same privileges as the plugin, posing a significant risk to the system.

References