CVE-2026-42428

7.5 highEPSS 0.1%

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

Severity

CVSS 4.0

7.5 high

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-353
Published: 2026-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openclaw:openclaw

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-3vvq-q2qc-7rmp	npm	openclaw	<2026.4.8	2026.4.8

References

https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5
https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp
https://www.vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads

Check your stack JSON