{"data":{"id":"e1ac2f67-5b5c-4e8c-9344-aa98b6a9fbf0","title":"GHSA-fh3f-q9qw-93j9: OpenClaw replaced a deprecated sandbox hash algorithm","summary":"The openclaw npm package, versions <= 2026.2.14, used SHA-1 to hash normalized Docker and browser sandbox configuration payloads for the sandbox identifier cache key. Because these deterministic IDs decide whether an existing sandbox container can be reused, a hash collision could let one configuration be treated as another, raising the risk of cache poisoning and unsafe sandbox state reuse. The fix replaces the hash with SHA-256 and is pre-set for release in version 2026.2.15.","solution":"Fixed in 2026.2.15 (commit 559c8d993), which switches these deterministic hashes from SHA-1 to SHA-256.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-fh3f-q9qw-93j9","publishedAt":"2026-02-19T19:41:07.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@<= 2026.2.14 (fixed: 2026.2.15)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-fh3f-q9qw-93j9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-16T03:56:42.422Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:40:48.600Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.15","matchedVersion":"2026.2.15","fixReleasedAt":"2026-02-16T03:56:42.422Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:48.454Z"}]}}