{"action":"Upgrade openclaw to 2026.2.19 or later.","affected":[{"fixed":"2026.2.19","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.19"],"ghsa_id":"GHSA-2mc2-g238-722j","id":"tcs_01M5KETJ0CTR6RY9J67YC4PPY6","modified_at":"2026-03-04T15:10:06.412827Z","published_at":"2026-03-03T21:35:21Z","references":["https://osv.dev/vulnerability/GHSA-2mc2-g238-722j","https://github.com/openclaw/openclaw/security/advisories/GHSA-2mc2-g238-722j","https://github.com/openclaw/openclaw/commit/49d0def6d1e88f002026b1d2a35aa615d48a751a","https://github.com/openclaw/openclaw"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-2mc2-g238-722j","url":"https://osv.dev/vulnerability/GHSA-2mc2-g238-722j"}],"summary":"OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)"}