CVE-2026-28393 is a path traversal flaw in how OpenClaw loads hook transform modules. Someone who can change the hooks configuration can make the gateway load and run an arbitrary JavaScript module. NVD scores it 7.7. Versions from 2.0.0-beta3 to 2026.2.13 are affected. Upgrade to 2026.2.14.
What's affected
The GitHub advisory GHSA-7xhj-55q9-pc3m lists affected versions from 2.0.0-beta3 up to and including 2026.2.13 of the npm package openclaw, with 2026.2.14 patched.
The advisory is clear about the precondition. The attacker must be able to write the OpenClaw configuration, or update the hooks configuration through authenticated configuration mechanisms. The advisory rates it Moderate at 6.0 with local attack vector and high privileges required. NVD scores it 7.7 with a local vector and no privileges required, so the two sources disagree on how high that bar is. Read the precondition as the real filter.
The weakness is CWE-22 (Path Traversal). The hook mapping setting hooks.mappings[].transform.module is imported and executed when webhooks are processed.
How to check if you're exposed
Check which OpenClaw versions you run.
npm ls openclaw
npm ls -g openclaw
Then check who and what can change the OpenClaw configuration. Look at file permissions on the config directory and at any admin interface or automation that edits it. The advisory says the fixed behaviour confines transform modules to the transforms directory under the OpenClaw home, so also look for hook mappings that point outside that directory.
What to do now
- Upgrade openclaw to 2026.2.14 or later.
- Tighten permissions on the OpenClaw configuration so only the service owner and administrators can write it.
- Review existing hook mappings and make sure every transform module lives in the intended transforms directory.
- Protect the hook endpoint's token as a secret, because triggering a hook needs the correct token according to the advisory.
- Run the gateway as a low privileged user so any code that loads has limited reach.
Why it matters
Two small mistakes combine. Hook mappings let an operator name a module to transform incoming webhook data, and the module path was resolved without a containment check. Absolute paths and parent directory references were accepted, so the path could point anywhere on disk.
That turns a configuration value into a code execution primitive. Whatever module the path names runs with the privileges of the gateway process. The advisory's fix constrains the transforms directory to a fixed root and rejects anything that resolves outside it.
The fact that this requires config write access reduces risk but does not remove it. Configuration can be reachable through other bugs, through shared automation and through over-broad permissions. Treat the ability to write config as equivalent to code execution on the gateway, and protect it that way.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Can an unauthenticated visitor trigger this?
Not from the advisory's description. It requires the ability to write or update OpenClaw's hooks configuration.
What does the fix do?
It confines hook transform modules to the OpenClaw transforms directory and rejects absolute paths and traversal outside it.
Sources
Last reviewed: 19 October 2026.
