{"action":"Upgrade openclaw to 2026.2.21 or later.","affected":[{"fixed":"2026.2.21","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-4039"],"ecosystem":"npm","epss":0.00329,"exploited":false,"fixed_versions":["2026.2.21"],"ghsa_id":"GHSA-82g8-464f-2mv7","id":"tcs_01M5KFBCDC1KM36BJQD5KDJB7J","modified_at":"2026-03-14T05:26:20.272874Z","published_at":"2026-02-27T21:36:17Z","references":["https://osv.dev/vulnerability/GHSA-82g8-464f-2mv7","https://github.com/openclaw/openclaw/security/advisories/GHSA-82g8-464f-2mv7","https://nvd.nist.gov/vuln/detail/CVE-2026-4039","https://github.com/openclaw/openclaw/commit/8c9f35cdb51692b650ddf05b259ccdd75cc9a83c","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.2.21"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-82g8-464f-2mv7","url":"https://osv.dev/vulnerability/GHSA-82g8-464f-2mv7"},{"source":"nvd","source_id":"CVE-2026-4039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4039"}],"summary":"OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)"}