Cases

GHSA-2qrv-rc5x-2g2h

MODERATEView advisory
SeverityMODERATE
Repositoryopenclaw/openclaw
PublishedApr 7, 2026, 6:15 PM
Ref4251ad6638e7fe74f81877b2af8f069b7131c17b
Advisory summary

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

Curator analysis
Synopsis

Built-in channel setup could resolve a workspace-shadowed channel plugin before checking whether that workspace plugin was trusted, letting an untrusted workspace plugin run during setup/login for a bundled channel id.

Vulnerability classes
trust boundary bypassuntrusted code executionplugin shadowing
Sink hints

src/commands/channel-setup/channel-plugin-resolution.ts

This is the setup-resolution path for channel plugins. The fix adds trust checks for workspace-origin catalog entries and falls back to non-workspace resolution when the shadowing workspace plugin is not explicitly enabled.

src/channels/plugins/catalog.ts

Catalog entries gained origin tracking and an excludeWorkspace option here. That supports the fix for ignoring workspace-origin shadows during built-in channel setup resolution.

Expected components
channel setup plugin resolutionchannel plugin catalog

Model scores(5)

z-ai/glm-5.1excellent
Target Alignment
29
Source To Sink Reasoning
28
Impact And Exploitability
17
Evidence Quality
9
Overclaim Control
9
anthropic/claude-opus-4.6excellent
Target Alignment
28
Source To Sink Reasoning
27
Impact And Exploitability
18
Evidence Quality
8
Overclaim Control
10
openai/gpt-5.4excellent
Target Alignment
28
Source To Sink Reasoning
27
Impact And Exploitability
18
Evidence Quality
8
Overclaim Control
10
moonshotai/kimi-k2.5excellent
Target Alignment
28
Source To Sink Reasoning
26
Impact And Exploitability
17
Evidence Quality
8
Overclaim Control
7
google/gemini-3.1-pro-previewpartial
Target Alignment
22
Source To Sink Reasoning
19
Impact And Exploitability
10
Evidence Quality
8
Overclaim Control
2