{"action":"Upgrade openclaw to 2026.3.8 or later.","affected":[{"fixed":"2026.3.8","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32921"],"ecosystem":"npm","epss":0.00333,"exploited":false,"fixed_versions":["2026.3.8"],"ghsa_id":"GHSA-8g75-q649-6pv6","id":"tcs_01M5KFCTXY2SAP0C6S2Q18A71V","modified_at":"2026-04-06T22:56:23.819082Z","published_at":"2026-03-12T14:21:28Z","references":["https://osv.dev/vulnerability/GHSA-8g75-q649-6pv6","https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6","https://nvd.nist.gov/vuln/detail/CVE-2026-32921","https://github.com/openclaw/openclaw/commit/c76d29208bf6a7f058d2cf582519d28069e42240","https://github.com/openclaw/openclaw/commit/cf3a479bd1204f62eef7dd82b4aa328749ae6c91","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-script-content-modification-via-mutable-operand-binding-in-system-run"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-8g75-q649-6pv6","url":"https://osv.dev/vulnerability/GHSA-8g75-q649-6pv6"}],"summary":"OpenClaw's system.run approvals did not bind mutable script operands across approval and execution"}