{"action":"Upgrade openclaw to 2026.4.5 or later.","affected":[{"fixed":"2026.4.5","introduced":"2026.3.22"}],"component":"openclaw","cve_ids":["CVE-2026-43570"],"ecosystem":"npm","epss":0.00323,"exploited":false,"fixed_versions":["2026.4.5"],"ghsa_id":"GHSA-35mw-5vvr-vrxc","id":"tcs_01M5KEW365N81GHSRXS8S7QSP4","modified_at":"2026-07-08T08:26:12.338087638Z","published_at":"2026-05-05T12:31:39Z","references":["https://osv.dev/vulnerability/GHSA-35mw-5vvr-vrxc","https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6","https://nvd.nist.gov/vuln/detail/CVE-2026-43570","https://github.com/openclaw/openclaw/commit/94b0062e90467e1582b47cc971f308457c537f3a","https://github.com/openclaw/openclaw/commit/b1dd3ded3589f6fa60ab85b3930a82d538edaeae","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-remote-marketplace-repository-path-handling"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-35mw-5vvr-vrxc","url":"https://osv.dev/vulnerability/GHSA-35mw-5vvr-vrxc"}],"summary":"OpenClaw contains a symlink traversal vulnerability"}