CyberRota
← Ana sayfaya dön

CVE-2026-45004

HIGH · CVSS 7.8 EPSS %0.01 Public Exploit

Kaynak: NVD + CISA KEV + EPSS · Yayınlanma: 2026-05-11T18:16:40.673 · Çekilme zamanı: 2026-06-09T06:00:36.662028+00:00

CyberRota Yorumu

Detaylı analiz gerekiyor.

Public Exploit Sinyali

Bu CVE için açıklama veya referanslarda public exploit / PoC / GitHub / Metasploit sinyali tespit edildi.

Tespit Edilen Sinyaller
arbitrary code execution code execution
GitHub PoC Linkleri
github.com ↗ github.com ↗

Not: Bu bağlantılar yalnızca güvenlik araştırması ve doğrulama amacıyla listelenmiştir.

CVE
CVE-2026-45004
Severity
HIGH
CVSS
7.8
EPSS
%0.01
Java

Orijinal NVD Açıklaması

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository and convincing a user to run OpenClaw commands from that directory.