AI agent vulnerability · OpenClaw

CVE-2026-28452: OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

mediumCVSS 4.0 6.7 · 3.1 6.5GHSA-h89v-j3x9-8wqj

Summary Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows. Affected Packages / Versions - openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3 Details Affected component: src/infra/archive.ts (extractArchive). The extractor now enforces resource budgets (entry count and extracted byte limits;

Published Feb 18, 2026 · Updated Mar 6, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.14
Fixed in: 2026.2.14
Check: npm ls openclaw

clawdbot

Ecosystem: npm
Affected: <= 2026.1.24-3
Fixed in: No patched version yet
Check: npm ls clawdbot

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

Affected Packages / Versions

openclaw (npm): <= 2026.2.13
clawdbot (npm): <= 2026.1.24-3

Details

Affected component: src/infra/archive.ts (extractArchive).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

Fix Commit(s)

openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71
openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

Release Process Note

This advisory will be updated with patched versions once the next npm release containing the fix is published.

Credits

Thanks @vincentkoc for reporting.

Credited to vincentkoc.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries