{"data":{"id":"067a8ae9-61ee-4efd-8ca3-6ef2331db20b","title":"GHSA-xwjm-j929-xq7c: OpenClaw has a Path Traversal in Browser Download Functionality","summary":"OpenClaw browser download helpers in the npm package `openclaw` accepted an unsanitized output path. Through the browser control gateway routes, this allowed path traversal to write downloads outside the intended OpenClaw temp downloads directory. The issue is not exposed via the AI agent tool schema, and exploitation requires authenticated CLI access or an authenticated gateway RPC token.","solution":"Upgrade to `openclaw` >=2026.2.13.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-xwjm-j929-xq7c","publishedAt":"2026-02-18T17:37:52.000Z","cveId":"CVE-2026-26972","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@>= 2026.1.12, <= 2026.2.12 (fixed: 2026.2.13)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00226,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-xwjm-j929-xq7c"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-14T03:20:08.219Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:40:58.367Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.13","matchedVersion":"2026.2.13","fixReleasedAt":"2026-02-14T03:20:08.219Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:58.220Z"}]}}