Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/openclaw@2.0.0-beta3
purl pkg:npm/openclaw@2.0.0-beta3
Tags Ghost
Next non-vulnerable version 2026.4.23
Latest non-vulnerable version 2026.4.23
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-jgcg-v35t-tuca
Aliases:
CVE-2026-28393
GHSA-7xhj-55q9-pc3m
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading OpenClaw hook mapping transforms could be loaded via absolute paths or `..` traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration.
2026.2.14
Affected by 502 other vulnerabilities.
VCID-muy6-vhj5-abe6
Aliases:
GHSA-hv93-r4j3-q65f
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied `sessionKey` values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.
2026.2.12
Affected by 543 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T22:02:23.833614+00:00 GHSA Importer Affected by VCID-jgcg-v35t-tuca https://github.com/advisories/GHSA-7xhj-55q9-pc3m 38.6.0
2026-06-05T21:58:51.246895+00:00 GHSA Importer Affected by VCID-muy6-vhj5-abe6 https://github.com/advisories/GHSA-hv93-r4j3-q65f 38.6.0
2026-06-02T04:51:08.430016+00:00 GitLab Importer Affected by VCID-jgcg-v35t-tuca https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/CVE-2026-28393.yml 38.6.0
2026-06-02T04:50:09.419478+00:00 GitLab Importer Affected by VCID-muy6-vhj5-abe6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-hv93-r4j3-q65f.yml 38.6.0