npm/openclaw CVE-2026-43578: critical 9.1, EPSS 0.29%
OpenClaw: Heartbeat owner downgrade missed local async exec completion events
Action: Upgrade openclaw to 2026.4.10 or later.
npm i openclaw@2026.4.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 2026.3.31 | 2026.4.10 | - |
Fixed versions
| 2026.4.10 |
Sources
- osv: GHSA-g375-h3v6-4873
- nvd: CVE-2026-43578
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g375-h3v6-4873
- https://github.com/openclaw/openclaw/pull/64376
- https://github.com/openclaw/openclaw/commit/19a2e9ddb5a8a494abcba812bb11f51075026a27
- https://github.com/openclaw/openclaw
CVE-2026-43578 · published · modified · JSON