[openclaw] OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

**[openclaw] OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories**

Summary OpenClaw automatically discovered and loaded plugins from .openclaw/extensions/ inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory. Impact Opening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account. Affected versions openclaw <= 2026.3.11 Patch Fixed in openclaw 2026.3.12. Workspace plugin loading now requires explicit trusted state before execution...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.