{"action":"Upgrade openclaw to 2026.2.26 or later.","affected":[{"fixed":"2026.2.26","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.26"],"ghsa_id":"GHSA-qcc4-p59m-p54m","id":"tcs_01M5KG5VZNNRBFC8KYE16A8GQA","modified_at":"2026-03-14T02:39:11.765229Z","published_at":"2026-03-12T14:21:54Z","references":["https://osv.dev/vulnerability/GHSA-qcc4-p59m-p54m","https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc4-p59m-p54m","https://github.com/openclaw/openclaw/commit/4fd29a35bb85a1898ebff518364c467058b50e14","https://github.com/openclaw/openclaw"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"GHSA-qcc4-p59m-p54m","url":"https://osv.dev/vulnerability/GHSA-qcc4-p59m-p54m"}],"summary":"OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary"}