{"action":"Upgrade openclaw to 2026.3.31 or later.","affected":[{"fixed":"2026.3.31","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41364"],"ecosystem":"npm","epss":0.00533,"exploited":false,"fixed_versions":["2026.3.31"],"ghsa_id":"GHSA-fv94-qvg8-xqpw","id":"tcs_01M5KFP9P2BVHBQQF78S98RY96","modified_at":"2026-05-06T19:26:29.099847Z","published_at":"2026-04-02T21:23:32Z","references":["https://osv.dev/vulnerability/GHSA-fv94-qvg8-xqpw","https://github.com/openclaw/openclaw/security/advisories/GHSA-fv94-qvg8-xqpw","https://nvd.nist.gov/vuln/detail/CVE-2026-41364","https://github.com/openclaw/openclaw/commit/3d5af14984ac1976c747a8e11581d697bd0829dc","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.3.31","https://www.vulncheck.com/advisories/openclaw-arbitrary-file-write-via-symlink-following-in-ssh-sandbox-tar-upload"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-fv94-qvg8-xqpw","url":"https://osv.dev/vulnerability/GHSA-fv94-qvg8-xqpw"}],"summary":"OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host"}