https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T13:42:23.473932+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-32920 BREW-openclaw-cli-CVE-2026-32920 — OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories 2026-10-05T13:42:23.536110+00:00

Affected: Homebrew: openclaw-cli

### Summary

OpenClaw automatically discovered and loaded plugins from `.openclaw/extensions/` inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory.

### Impact

Opening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Workspace plugin loading now requires explicit trusted state before execution. Users should update to `2026.3.12` or later and avoid running OpenClaw inside untrusted repositories on older releases.

 https://cve.radiocsirt.org/vuln/cnvd-2026-19641 cnvd-2026-19641 2026-10-05T13:42:23.536170+00:00 cnvd-2026-19641 https://cve.radiocsirt.org/vuln/euvd-2026-329469 EUVD-2026-329469 2026-10-05T13:42:23.536189+00:00 EUVD-2026-329469 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32920 fkie_cve-2026-32920 2026-10-05T13:42:23.536201+00:00

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.

 https://cve.radiocsirt.org/vuln/ghsa-99qw-6mr3-36qr GHSA-99qw-6mr3-36qr — OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories 2026-10-05T13:42:23.536223+00:00

Affected: npm: openclaw

### Summary

OpenClaw automatically discovered and loaded plugins from `.openclaw/extensions/` inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory.

### Impact

Opening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Workspace plugin loading now requires explicit trusted state before execution. Users should update to `2026.3.12` or later and avoid running OpenClaw inside untrusted repositories on older releases.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0711 WID-SEC-W-2026-0711 — OpenClaw: Mehrere Schwachstellen 2026-10-05T13:42:23.536252+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.