{"action":"Upgrade openclaw to 2026.2.14 or later.","affected":[{"fixed":"2026.2.14","introduced":"2026.1.5"}],"component":"openclaw","cve_ids":["CVE-2026-28456"],"ecosystem":"npm","epss":0.0047,"exploited":false,"fixed_versions":["2026.2.14"],"ghsa_id":"GHSA-v6c6-vqqg-w888","id":"tcs_01M5KGAZZ3SFD55NWG1Y5E9XZ7","modified_at":"2026-03-06T01:17:40.920726Z","published_at":"2026-02-18T00:57:48Z","references":["https://osv.dev/vulnerability/GHSA-v6c6-vqqg-w888","https://github.com/openclaw/openclaw/security/advisories/GHSA-v6c6-vqqg-w888","https://nvd.nist.gov/vuln/detail/CVE-2026-28456","https://github.com/openclaw/openclaw/commit/35c0e66ed057f1a9f7ad2515fdcef516bd6584ce","https://github.com/openclaw/openclaw/commit/a0361b8ba959e8506dc79d638b6e6a00d12887e4","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.2.14","https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-unsafe-hook-module-path-handling"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-v6c6-vqqg-w888","url":"https://osv.dev/vulnerability/GHSA-v6c6-vqqg-w888"}],"summary":"OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway"}