{"action":"Upgrade openclaw to 2026.2.14 or later.","affected":[{"fixed":"2026.2.14","introduced":"2.0.0-beta3"}],"component":"openclaw","cve_ids":["CVE-2026-28393"],"ecosystem":"npm","epss":0.0051,"exploited":false,"fixed_versions":["2026.2.14"],"ghsa_id":"GHSA-7xhj-55q9-pc3m","id":"tcs_01M5KFB7N55TPNRZ9M8HV2EQMC","modified_at":"2026-03-06T01:16:25.062189Z","published_at":"2026-03-03T18:09:54Z","references":["https://osv.dev/vulnerability/GHSA-7xhj-55q9-pc3m","https://github.com/openclaw/openclaw/security/advisories/GHSA-7xhj-55q9-pc3m","https://nvd.nist.gov/vuln/detail/CVE-2026-28393","https://github.com/openclaw/openclaw/commit/18e8bd68c5015a894f999c6d5e6e32468965bfb5","https://github.com/openclaw/openclaw/commit/a0361b8ba959e8506dc79d638b6e6a00d12887e4","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-beta-arbitrary-javascript-module-loading-via-hook-transform-path-traversal"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-7xhj-55q9-pc3m","url":"https://osv.dev/vulnerability/GHSA-7xhj-55q9-pc3m"}],"summary":"OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading"}