npm/openclaw CVE-2026-34426, CVE-2026-34510: medium, EPSS 0.26%

OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

Action: Upgrade openclaw to 2026.3.22 or later.

npm i openclaw@2026.3.22

Affected

Fixed versions

Sources

• osv: GHSA-h3x4-hc5v-v2gm
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm
• https://nvd.nist.gov/vuln/detail/CVE-2026-34426
• https://github.com/openclaw/openclaw/pull/59182
• https://github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5
• https://github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901
• https://github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7
• https://github.com/openclaw/openclaw
• https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-environment-variable-normalization

CVE-2026-34426, CVE-2026-34510 · published 2026-03-26T19:07:55Z · modified 2026-07-08T08:11:38.347216822Z · JSON