{"action":"Upgrade openclaw to 2026.4.8 or later.","affected":[{"fixed":"2026.4.8","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.4.8"],"ghsa_id":"GHSA-w9j9-w4cp-6wgr","id":"tcs_01M5KGEN5PRMY0YCCCRDAMZDG9","modified_at":"2026-07-08T07:14:00.205744578Z","published_at":"2026-04-09T17:37:04Z","references":["https://osv.dev/vulnerability/GHSA-w9j9-w4cp-6wgr","https://github.com/openclaw/openclaw/security/advisories/GHSA-w9j9-w4cp-6wgr","https://github.com/openclaw/openclaw"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-w9j9-w4cp-6wgr","url":"https://osv.dev/vulnerability/GHSA-w9j9-w4cp-6wgr"}],"summary":"OpenClaw Host-Exec Environment Variable Injection"}