{"action":"Upgrade openclaw to 2026.2.22 or later.","affected":[{"fixed":"2026.2.22","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.22"],"ghsa_id":"GHSA-5h2c-8v84-qpvr","id":"tcs_01M5KF3S0FR42DKVTP1FKY4YF2","modified_at":"2026-03-04T15:12:05.553863Z","published_at":"2026-03-03T21:39:51Z","references":["https://osv.dev/vulnerability/GHSA-5h2c-8v84-qpvr","https://github.com/openclaw/openclaw/security/advisories/GHSA-5h2c-8v84-qpvr","https://github.com/openclaw/openclaw/commit/9363c320d8ffe29290906752fab92621da02c3f7","https://github.com/openclaw/openclaw"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-5h2c-8v84-qpvr","url":"https://osv.dev/vulnerability/GHSA-5h2c-8v84-qpvr"}],"summary":"OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths"}