9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qrq5-wjgg-rvqw

GHSA-qrq5-wjgg-rvqw: OpenClaw has a Path Traversal in Plugin Installation

Summary

OpenClaw's plugin installation path derivation could be abused by a malicious plugin package.json name to escape the intended extensions directory and write files to a parent directory.

Affected Packages / Versions

Package: openclaw (npm)
Affected: >= 2026.1.20, < 2026.2.1
Fixed: >= 2026.2.1
Latest published as of 2026-02-14: 2026.2.13 (not affected)

Details

In affected versions, the plugin installer derives the on-disk install directory from the plugin manifest name without robust validation.

Example (POSIX / macOS / Linux):

Manifest name: @malicious/..
unscopedPackageName("@malicious/..") yields ..
The install directory becomes path.join(extensionsDir, ".."), which resolves to the parent of the extensions directory.

This can cause plugin files to be written into the OpenClaw state directory (default ~/.openclaw/) rather than a subdirectory of ~/.openclaw/extensions/.

Note: on Windows, affected versions also failed to sanitize backslashes (\\) in the derived directory name, which can enable deeper traversal via crafted pluginId strings.

Impact

This issue requires a user/operator to install untrusted plugin content (for example via openclaw plugins install). In many deployments, plugin installation is an operator-only action and may be performed on a separate machine; that operational separation significantly reduces exposure for the primary gateway/runtime host.

On hosts where untrusted plugins are installed, this can lead to unintended file writes outside the extensions directory (potentially overwriting files under the OpenClaw state directory). On Windows, the traversal surface may extend further, within the privileges of the user running OpenClaw.

Miggo Vulnerability Database

→

GHSA-qrq5-wjgg-rvqw

GHSA-qrq5-wjgg-rvqw:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.1.20, < 2026.2.1	2026.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in OpenClaw's plugin and hook installation process. The root cause is the failure to properly sanitize the name field from a plugin's or hook's package.json file before using it to construct an installation file path. An attacker can set the name to a value like "@malicious/..", which, after processing, results in ".." being used as a directory name. When this is joined with the base installation directory path, it resolves to the parent directory, allowing the plugin or hook files to be written outside of the intended sandboxed location (e.g., ~/.openclaw/extensions/).

The analysis of the patch d03eca8450dc493b198a88b105fd180895238e57 reveals that several functions were responsible for or contributed to this vulnerability. The core issue lies in functions that directly construct the path, such as resolvePluginInstallDir and installPluginFromPackageDir, which used path.join on unsanitized input. The same flawed logic was present for hooks in resolveHookInstallDir. Other identified functions like installHookPackageFromDir, updateNpmInstalledPlugins, and registerHooksCli are also included as they are key entry points in the application's logic that invoke the vulnerable path-building functions, making them part of the exploitable execution flow.

Vulnerable functions

resolvePluginInstallDir

src/plugins/install.ts

The function `resolvePluginInstallDir` constructs an installation path by joining a base directory with a plugin ID. The `pluginId` is not properly sanitized, allowing for path traversal characters like '..'. This could lead to files being written outside the intended extensions directory.

installPluginFromPackageDir

src/plugins/install.ts

The function `installPluginFromPackageDir` determines the `pluginId` from the package manifest's `name` field. It then constructs the installation path using this ID without proper sanitization, leading to a path traversal vulnerability. An attacker could craft a malicious package name to write files outside the intended directory.

resolveHookInstallDir

src/hooks/install.ts

Similar to `resolvePluginInstallDir`, this function constructs an installation path for a hook using an unsanitized `hookId`. This allows for path traversal, enabling a malicious hook to be installed outside the designated hooks directory.

installHookPackageFromDir

src/hooks/install.ts

This function calls the vulnerable `resolveHookInstallDir` to determine the installation directory for a hook package. By using the unsanitized `hookPackId` derived from the package name, it becomes an entry point for the path traversal vulnerability.

installHookFromDir

src/hooks/install.ts

This function installs a hook from a directory and uses the vulnerable `resolveHookInstallDir` function to determine the target installation path. The `hookName` is not validated, making it susceptible to path traversal.

updateNpmInstalledPlugins

src/plugins/update.ts

When updating installed plugins, this function resolves the installation path by calling the vulnerable `resolvePluginInstallDir`. This means an existing plugin with a crafted name could cause files to be written to an unintended location during an update.

registerHooksCli

src/cli/hooks-cli.ts

This function, part of the command-line interface for managing hooks, resolves the hook's installation path using the vulnerable `resolveHookInstallDir`. This exposes a vector for path traversal when interacting with hooks via the CLI.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-qrq5-wjgg-rvqw: OpenClaw has a Path Traversal in Plugin Installation

Summary

Affected Packages / Versions

Details

Impact

GHSA-qrq5-wjgg-rvqw:

9.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

9.3

9.3

Basic Information

Basic Information

Technical Details

GHSA-qrq5-wjgg-rvqw: OpenClaw has a Path Traversal in Plugin Installation

Summary

Affected Packages / Versions

Details

Impact

Fix

Fix Commit(s)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI