{"action":"Upgrade openclaw to 2026.4.2 or later.","affected":[{"fixed":"2026.4.2","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41383"],"ecosystem":"npm","epss":0.00371,"exploited":false,"fixed_versions":["2026.4.2"],"ghsa_id":"GHSA-m34q-h93w-vg5x","id":"tcs_01M5KFZE3W7X882BY51NXFEDFJ","modified_at":"2026-05-05T16:11:37.058030Z","published_at":"2026-04-07T18:14:57Z","references":["https://osv.dev/vulnerability/GHSA-m34q-h93w-vg5x","https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x","https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25","https://github.com/openclaw/openclaw"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-m34q-h93w-vg5x","url":"https://osv.dev/vulnerability/GHSA-m34q-h93w-vg5x"},{"source":"nvd","source_id":"CVE-2026-41383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41383"}],"summary":"OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped"}