GHSA-qrq5-wjgg-rvqw: OpenClaw has a Path Traversal in Plugin Installation

February 17, 2026

OpenClaw’s plugin installation path derivation could be abused by a malicious plugin package.json name to escape the intended extensions directory and write files to a parent directory.

References

github.com/advisories/GHSA-qrq5-wjgg-rvqw
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e5
github.com/openclaw/openclaw/releases/tag/v2026.2.1
github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw

Code Behaviors & Features

Detect and mitigate GHSA-qrq5-wjgg-rvqw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →