{"action":"Upgrade openclaw to 2026.2.24 or later.","affected":[{"fixed":"2026.2.24","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.24"],"ghsa_id":"GHSA-9f72-qcpw-2hxc","id":"tcs_01M5KFFNX2G0XY04CXR4RACJTK","modified_at":"2026-03-04T15:14:41.045535Z","published_at":"2026-03-03T19:08:08Z","references":["https://osv.dev/vulnerability/GHSA-9f72-qcpw-2hxc","https://github.com/openclaw/openclaw/security/advisories/GHSA-9f72-qcpw-2hxc","https://github.com/openclaw/openclaw/commit/370d115549c0dadace0902775eea0d5094aedfdc","https://github.com/openclaw/openclaw"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-9f72-qcpw-2hxc","url":"https://osv.dev/vulnerability/GHSA-9f72-qcpw-2hxc"}],"summary":"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs"}