{"action":"Upgrade openclaw to 2026.2.14 or later.","affected":[{"fixed":"2026.2.14","introduced":"2026.1.16-2"}],"component":"openclaw","cve_ids":["CVE-2026-28486"],"ecosystem":"npm","epss":0.00177,"exploited":false,"fixed_versions":["2026.2.14"],"ghsa_id":"GHSA-v892-hwpg-jwqp","id":"tcs_01M5KGB7GRZ5WX4SVHJ7DGR8TG","modified_at":"2026-03-06T01:17:34.967987Z","published_at":"2026-03-02T23:23:03Z","references":["https://osv.dev/vulnerability/GHSA-v892-hwpg-jwqp","https://github.com/openclaw/openclaw/security/advisories/GHSA-v892-hwpg-jwqp","https://nvd.nist.gov/vuln/detail/CVE-2026-28486","https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-path-traversal-zip-slip-in-archive-extraction-via-installation-commands"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-v892-hwpg-jwqp","url":"https://osv.dev/vulnerability/GHSA-v892-hwpg-jwqp"}],"summary":"OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands"}