Skip to content
OpenAdvisories

Package · npm

clawdbot

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-25253 Public exploit EPSS 32%

    OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

    OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

    OpenClaw OpenClaw clawdbot npm