OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands
Summary
A path traversal (Zip Slip) issue in archive extraction during explicit installation commands could allow a crafted archive to write files outside the intended extraction directory.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
>=2026.1.16-2 <2026.2.14 - Fixed version:
2026.2.14
Affected Commands / Flows
This only affects users who run installation commands against an untrusted archive (local file or download URL), for example:
openclaw skills install(download+extract installers)openclaw hooks install(archive installs)openclaw plugins install(archive installs)openclaw signal install(signal-cli asset extraction)
It is not triggered by receiving messages or normal gateway operation.
Impact
Arbitrary file write as the current user. In the worst case this can be used for persistence or code execution if an attacker can convince a user to install a crafted archive.
Fix
- Fix commit:
3aa94afcfd12104c683c9cad81faf434d0dadf87 - Released in:
2026.2.14
Credits
OpenClaw thanks @markmusson for reporting.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | openclaw | >= 2026.1.16-2, < 2026.2.14 | 2026.2.14 |
Referencias
- https://github.com/openclaw/openclaw/security/advisories/GHSA-v892-hwpg-jwqp
- https://nvd.nist.gov/vuln/detail/CVE-2026-28486
- https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-path-traversal-zip-slip-in-archive-extraction-via-installation-commands
- Vector CVSS
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L- Debilidad (CWE)
CWE-22- Plataforma
- npm
- Paquete
openclaw- Publicada
- 02.03.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-v892-hwpg-jwqp - CC BY 4.0
Historial de vulnerabilidades: openclaw
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 588
- Primera → última
- 02.2026 07.2026
- Sin corrección
- 9
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 20
- Alta 215
- Media 299
- Baja 54
Divulgaciones por año
- 2026: 588
-
OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.