[CVE-2026-53810] OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extensio…

Descripción técnica

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, bypassing security scanning.

Puntuación CVSS

Score: 8.8/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Productos afectados

Openclaw — Openclaw

Debilidades (CWE)

CWE-829

Fuente oficial

Publicado en NIST NVD.