OpenClaw automatically loads plugins from the ".OpenClaw/extensions/" directory whenever a workspace is opened. This loading occurs without a trust or verification step, allowing a malicious actor to place a crafted plugin in a repository that is cloned locally. When a user opens that workspace with OpenClaw, the plugin executes, giving the attacker the ability to run arbitrary code on the victim’s machine, thereby compromising confidentiality, integrity and availability.

All OpenClaw installations released prior to version 2026.3.12 are vulnerable. The flaw is present in all builds that employ the automatic discovery of workspace plugins without trust validation.

With a CVSS score of 8.6, the vulnerability is categorized as high severity. The EPSS score is not provided, so the current exploit likelihood is uncertain; however, because the attack only requires a local repository containing malicious plugins, it can be executed by anyone who can influence the contents of a user's cloned workspace. The flaw is not listed in the CISA KEV catalog, but its potential for remote code execution makes it a high‑risk issue that can be exploited in environments where user-trusted plugins are not properly validated.