The vulnerability allows an attacker with trusted operator access to alter the marketplace runtime extension metadata so that unscanned plugin code can be loaded, leading to arbitrary code execution. This flaw is a type of CWE-829 over-privilege, permitting the execution of malicious code outside the intended application sandbox and potentially compromising confidentiality, integrity, and availability of the affected system.

OpenClaw software, all releases prior to version 2026.5.18. The vulnerability is present in all builds where marketplace runtime extensions are enabled and the application does not validate plugin metadata.

The CVSS score of 7.7 reflects a high‑severity flaw. Exploitability requires the attacker to have privileged operator access; no external public-facing attack vector is reported. Because the exploitation bypasses security scanning, a compromised extension can execute any code, making the potential impact severe. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so current evidence suggests exploitation is not yet widespread but the high severity warrants immediate attention.