{"action":"Upgrade openclaw to 2026.2.1 or later.","affected":[{"fixed":"2026.2.1","introduced":"2026.1.20"}],"component":"openclaw","cve_ids":["CVE-2026-28447"],"ecosystem":"npm","epss":0.00521,"exploited":false,"fixed_versions":["2026.2.1"],"ghsa_id":"GHSA-qrq5-wjgg-rvqw","id":"tcs_01M5KG731A69E2ENKAFWD2CTCG","modified_at":"2026-03-13T04:18:08.172762Z","published_at":"2026-02-17T21:39:24Z","references":["https://osv.dev/vulnerability/GHSA-qrq5-wjgg-rvqw","https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw","https://nvd.nist.gov/vuln/detail/CVE-2026-28447","https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e5","https://github.com/openclaw/openclaw/commit/d03eca8450dc493b198a88b105fd180895238e57","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.2.1","https://www.vulncheck.com/advisories/openclaw-beta-path-traversal-in-plugin-installation-via-package-name"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-qrq5-wjgg-rvqw","url":"https://osv.dev/vulnerability/GHSA-qrq5-wjgg-rvqw"}],"summary":"OpenClaw has a Path Traversal in Plugin Installation"}