Kurz gesagt
- CVE-2026-28452 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in openclaw (openclaw), clawdbot, openclaw.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.38%, höher als bei 32.0% aller Schwachstellen.
- Abhilfe: auf 2026.2.14 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.2.14
| 2026.2.14
|
| clawdbot npm | ≤ 2026.1.24-3
| No fix yet |
| openclaw npm | < 2026.2.14
| 2026.2.14
|
Description
Summary
Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.
Affected Packages / Versions
- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3
Details
Affected component: src/infra/archive.ts (extractArchive).
The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.
Fix Commit(s)
- openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71
- openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea
Release Process Note
This advisory will be updated with patched versions once the next npm release containing the fix is published.
Credits
Thanks @vincentkoc for reporting.
NVD description
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessive CPU, memory, and disk resources through high-expansion ZIP and TAR archives. Remote attackers can trigger resource exhaustion by providing maliciously crafted archive files during install or update operations, causing service degradation or system unavailability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free