CVE-2026-32920
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Mar 31, 2026
Vendor
unknown
Description
OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.