{"action":"Upgrade openclaw to 2026.2.19 or later.","affected":[{"fixed":"2026.2.19","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-22171"],"ecosystem":"npm","epss":0.00345,"exploited":false,"fixed_versions":["2026.2.19"],"ghsa_id":"GHSA-vj3g-5px3-gr46","id":"tcs_01M5KGC37TTRZ25WPKY4AX8853","modified_at":"2026-03-19T18:47:00.742997Z","published_at":"2026-03-03T18:42:28Z","references":["https://osv.dev/vulnerability/GHSA-vj3g-5px3-gr46","https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46","https://nvd.nist.gov/vuln/detail/CVE-2026-22171","https://github.com/openclaw/openclaw/commit/c821099157a9767d4df208c6b12f214946507871","https://github.com/openclaw/openclaw/commit/cdb00fe2428000e7a08f9b7848784a0049176705","https://github.com/openclaw/openclaw/commit/ec232a9e2dff60f0e3d7e827a7c868db5254473f","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-path-traversal-in-feishu-media-temporary-file-naming"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-vj3g-5px3-gr46","url":"https://osv.dev/vulnerability/GHSA-vj3g-5px3-gr46"},{"source":"nvd","source_id":"CVE-2026-22171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22171"}],"summary":"OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()"}