{"action":"Upgrade openclaw to 2026.3.13 or later.","affected":[{"fixed":"2026.3.13","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32917"],"ecosystem":"npm","epss":0.03203,"exploited":false,"fixed_versions":["2026.3.13"],"ghsa_id":"GHSA-g2f6-pwvx-r275","id":"tcs_01M5KFPPJRWSK6NSCD40C0M57E","modified_at":"2026-07-08T07:35:44.106061628Z","published_at":"2026-03-16T20:41:12Z","references":["https://osv.dev/vulnerability/GHSA-g2f6-pwvx-r275","https://github.com/openclaw/openclaw/security/advisories/GHSA-g2f6-pwvx-r275","https://github.com/openclaw/openclaw/commit/a54bf71b4c0cbe554a84340b773df37ee8e959de","https://github.com/openclaw/openclaw"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-g2f6-pwvx-r275","url":"https://osv.dev/vulnerability/GHSA-g2f6-pwvx-r275"}],"summary":"OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection"}