npm/openclaw CVE-2026-42438: high 7.7, EPSS 0.24%
OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure
Action: Upgrade openclaw to 2026.4.10 or later.
npm i openclaw@2026.4.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 2026.4.9 | 2026.4.10 | - |
Fixed versions
| 2026.4.10 |
Sources
- osv: GHSA-jhpv-5j76-m56h
- nvd: CVE-2026-42438
- https://github.com/openclaw/openclaw/security/advisories/GHSA-jhpv-5j76-m56h
- https://github.com/openclaw/openclaw/pull/64459
- https://github.com/openclaw/openclaw/commit/c949af9fabf3873b5b7c484090cb5f5ab6049a98
- https://github.com/openclaw/openclaw
CVE-2026-42438 · published · modified · JSON