{"action":"Upgrade openclaw to 2026.2.22 or later.","affected":[{"fixed":"2026.2.22","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-31993"],"ecosystem":"npm","epss":0.00303,"exploited":false,"fixed_versions":["2026.2.22"],"ghsa_id":"GHSA-5f9p-f3w2-fwch","id":"tcs_01M5KF3FCV9X51FJP829KXHD9Y","modified_at":"2026-03-19T21:41:20.597601Z","published_at":"2026-03-02T22:17:01Z","references":["https://osv.dev/vulnerability/GHSA-5f9p-f3w2-fwch","https://github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwch","https://nvd.nist.gov/vuln/detail/CVE-2026-31993","https://github.com/openclaw/openclaw/commit/5da03e622119fa012285cdb590fcf4264c965cb5","https://github.com/openclaw/openclaw/commit/e371da38aab99521c4e076cd3d95fd775e00b784","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-allowlist-parsing-mismatch-in-system-run-shell-chains"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-5f9p-f3w2-fwch","url":"https://osv.dev/vulnerability/GHSA-5f9p-f3w2-fwch"}],"summary":"OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains"}