OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths be…

OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a critical vulnerability in the Gateway component that allows arbitrary code execution. The vulnerability stems from insufficient validation of hook module paths before passing them to dynamic import() function. Attackers with gateway configuration modification access can exploit this to load and execute unintended local modules within the Node.js process. This represents a significant security risk for applications using affected OpenClaw versions. Multiple patches and security advisories have been released to address this issue.