deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-f7fh-qg34-x2xh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.5
Patched in: 2026.4.5

Summary: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets

Details:
## Summary

CDP /json/version WebSocket URL could pivot to untrusted second-hop targets.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.5`
- Patched versions: `>= 2026.4.5`

## Impact

A browser profile could trust a CDP `/json/version` response whose `webSocketDebuggerUrl` pointed at a different host, enabling a second-hop SSRF-style pivot.

## Technical Details

The fix normalizes and re-validates direct CDP WebSocket targets before connecting.

## Fix

The issue was fixed in #60469. The first stable tag containing the fix is `v2026.4.5`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `bc356cc8c2beaa747c71dd86cceab8f804699665`
- PR: #60469

## Release Process Note

Users should upgrade to `openclaw` 2026.4.5 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.
GitHub Security Advisory: GHSA-jhpv-5j76-m56h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.4.9, < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure

Details:
## Summary

OpenClaw's outbound host-media attachment read helper could enable host-local file reads based on global or agent-level read access without also honoring sender and group-scoped tool policy. In channel deployments that used `toolsBySender` or group policy to deny `read` for less-trusted senders, a denied sender could still trigger host-media attachment loading and cause readable local files to be returned through the outbound media path.

## Affected Versions

This issue is known to affect OpenClaw 2026.4.9. Earlier versions were not confirmed during triage, so the advisory range is intentionally scoped to `>= 2026.4.9 < 2026.4.10`.

## Impact

Affected deployments are those that both allow host read or filesystem root expansion at the global/agent level and rely on sender or group-scoped policy to deny `read` for some channel participants. In that configuration, the intended sender/group authorization boundary could be bypassed for outbound media reads, potentially disclosing host-local files readable by the OpenClaw process.

The issue does not require treating the model prompt as the security boundary. The vulnerable behavior was a concrete policy enforcement mismatch: sender/group policy denied `read`, while the host-media read helper could still be installed without that sender context.

## Resolution

Fixed in OpenClaw 2026.4.10 by PR #64459, commit `c949af9fabf3873b5b7c484090cb5f5ab6049a98`. The fix threads sender, session, channel, and account context into outbound media access resolution and intersects host-media read capability creation with the existing group tool policy for `read`. When a concrete sender/group override denies `read`, OpenClaw no longer creates the host `readFile` media capability.

Additional attachment canonicalization hardening shipped in 2026.4.14, but the authorization bypass described here was fixed in 2026.4.10.

## Credit

Thanks to @Telecaster2147 for reporting this issue.
GitHub Security Advisory: GHSA-66r7-m7xm-v49h
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: QQBot media tags could read arbitrary local files through reply text

Details:
## Summary

QQBot media tags could read arbitrary local files through reply text.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

QQBot outbound media tags in AI reply text could reference host-local paths outside the intended media storage boundary, allowing local file disclosure through outbound media handling.

## Technical Details

The fix enforces the media storage boundary for all outbound QQBot local file paths.

## Fix

The issue was fixed in #63271. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `604777e4414cc3b2ff8861f18f4fb04374c702c6`
- PR: #63271

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting this issue.
GitHub Security Advisory: GHSA-2cq5-mf3v-mx44
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.2.23, < 2026.4.12
Patched in: 2026.4.12

Summary: OpenClaw: busybox and toybox applet execution weakened exec approval binding

Details:
## Summary

busybox and toybox applet execution weakened exec approval binding.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.2.23 < 2026.4.12`
- Patched versions: `>= 2026.4.12`

## Impact

Opaque multi-call binaries such as `busybox` and `toybox` could obscure which applet or script-like behavior would actually run, weakening exec approval binding and risk classification.

## Technical Details

The fix treats `busybox` and `toybox` as opaque mutable script runners and fails closed rather than binding unsafe applet invocations.

## Fix

The issue was fixed in #65713. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `666f48d9b882a8a1415ca53f9567c72499d850c9`
- PR: #65713

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @decsecre583 for reporting this issue.
GitHub Security Advisory: GHSA-7jp6-r74r-995q
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Matrix profile config persistence was reachable from operator.write message tools

Details:
## Summary

Matrix profile config persistence was reachable from operator.write message tools.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Gateway `operator.write` message-tool paths could reach Matrix profile persistence that should have required admin-level authority.

## Technical Details

The fix gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from mutating persistent profile config.

## Fix

The issue was fixed in #62662. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `fe0f686c9228fffcec6de4011da45e69a6e23e54`
- PR: #62662

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-736r-jwj6-4w23
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.4.5, < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Sandboxed agents could escape exec routing via host=node override

Details:
## Summary

Sandboxed agents could escape exec routing via host=node override.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.5 < 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

A sandboxed agent could request `host: "node"` and route exec to a remote node instead of the intended sandbox execution path, bypassing the sandbox routing boundary.

## Technical Details

The fix blocks sandboxed exec escape to remote node targets and keeps routing aligned with the active sandbox policy.

## Fix

The issue was fixed in #63880. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `dffad08529202edbf34e4808788e1182fe10f6a9`
- PR: #63880

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-536q-mj95-h29h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage

Details:
## Summary

Browser press/type interaction routes missed complete navigation guard coverage.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Some browser press/type style interactions could trigger navigation without complete post-action SSRF policy enforcement.

## Technical Details

The fix applies a three-phase interaction navigation guard to navigation-capable interactions, including pressKey and type submit flows.

## Fix

The issue was fixed in #62023 and #63226 and #63889. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `049acf23cb03e1b92f5c71cd99c6ec5f35cc56fe`
- `5f5b3d733bdd791cb457f838514179e1288b10b3`
- `e0b8ddc1a55185aff1cf9e0e095014d2e4f1d894`
- PR: #62023, #63226, #63889

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-qmwg-qprg-3j38
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: < 2026.4.9
Patched in: 2026.4.9

Summary: OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads

Details:
## Summary

Browser interaction routes could pivot into local CDP and regain file reads.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.9`
- Patched versions: `>= 2026.4.9`

## Impact

Browser act/evaluate interactions could trigger navigation into the local CDP origin and then create or read disallowed `file://` pages despite direct navigation guards.

## Technical Details

The fix re-checks browser URLs after interaction-driven navigations and blocks targets that violate the configured navigation policy.

## Fix

The issue was fixed in #63226. The first stable tag containing the fix is `v2026.4.9`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `5f5b3d733bdd791cb457f838514179e1288b10b3`
- PR: #63226

## Release Process Note

Users should upgrade to `openclaw` 2026.4.9 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.
GitHub Security Advisory: GHSA-939r-rj45-g2rj
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 2026.4.9
Patched in: 2026.4.9

Summary: OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins

Details:
## Summary

Workspace provider auth choices could auto-enable untrusted provider plugins.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.9`
- Patched versions: `>= 2026.4.9`

## Impact

Non-interactive onboarding could select a provider auth choice shadowed by an untrusted workspace plugin, auto-enabling that plugin during auth setup.

## Technical Details

The fix prefers trusted provider origins for auth choices and excludes untrusted workspace choices unless they are explicitly enabled.

## Fix

The issue was fixed in #62368. The first stable tag containing the fix is `v2026.4.9`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `2d97eae53e212ae26f3aebcd6a50ffc6877f770d`
- PR: #62368

## Release Process Note

Users should upgrade to `openclaw` 2026.4.9 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent for reporting this issue.
GitHub Security Advisory: GHSA-527m-976r-jf79
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.7)
CWE: CWE-862: Missing Authorization, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

Details:
## Summary

Existing-session browser interaction routes bypassed SSRF policy enforcement.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.

## Technical Details

The fix guards existing-session navigation and interaction routes with browser navigation policy checks.

## Fix

The issue was fixed in #64370. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `daeb74920d5ad986cb[PII_REDACTED]37e23221e93a`
- PR: #64370

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-rj2p-j66c-mgqh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.5)
CWE: CWE-862: Missing Authorization, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Browser tabs action select and close routes bypassed SSRF policy

Details:
## Summary

Browser tabs action select and close routes bypassed SSRF policy.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.

## Technical Details

The fix enforces browser SSRF policy in the select and close tab-action branches.

## Fix

The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `48c0347921b7e9438af0312968fc360ca88023f3`
- PR: #63332

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.
GitHub Security Advisory: GHSA-f3h5-h452-vp3j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Nostr profile mutation routes allowed operator.write config persistence

Details:
## Summary

Nostr profile mutation routes allowed operator.write config persistence.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin authority.

## Technical Details

The fix requires `operator.admin` scope for Nostr profile mutation routes.

## Fix

The issue was fixed in #63553. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `6517c700de9bb0ee11b41ab625ef3b63d01b6083`
- PR: #63553

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-525j-hqq2-66r4
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-1327: Binding to an Unrestricted IP Address
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

Details:
## Summary

Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

The sandbox browser CDP relay could bind too broadly, exposing Chrome DevTools Protocol access outside the intended local/sandbox source range.

## Technical Details

The fix enforces CDP source-range restriction by default and avoids broad `0.0.0.0` exposure unless explicitly configured.

## Fix

The issue was fixed in #61404. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `fbf11ebdb7110632f93926d0ac7b48f04cb44d77`
- PR: #61404

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-82qx-6vj7-p8m2
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere, CWE-862: Missing Authorization
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows

Details:
## Summary

Channel setup catalog lookups could include untrusted workspace plugin shadows.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Channel setup could resolve a workspace plugin shadow before a bundled channel plugin, causing setup-time plugin loading without the intended trust gate.

## Technical Details

The fix routes setup catalog lookups through trusted catalog paths and uses `excludeWorkspace: true` where setup should not include workspace shadows.

## Fix

The issue was fixed in the advisory fix branch. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `1fede43b948df40ca8674511d4bd08d39f6c5837`
- PR: private advisory fork

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-jf25-7968-h2h5
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: screen_record outPath bypassed workspace-only filesystem guard

Details:
## Summary

screen_record outPath bypassed workspace-only filesystem guard.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

The node-host screen recording tool could honor an `outPath` outside the workspace guard, allowing an authorized tool call to write outside the intended workspace boundary.

## Technical Details

The fix applies the workspace-root guard to node tool `outPath` handling, including screen recording paths.

## Fix

The issue was fixed in #63551. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `635bb35b68d8faa5bfa2fda35feadd315122748a`
- PR: #63551

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @anshumanbh for reporting this issue.
GitHub Security Advisory: GHSA-53vx-pmqw-863c
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF), CWE-1188: Initialization of a Resource with an Insecure Default
Vulnerable versions: < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: Browser SSRF policy default allowed private-network navigation

Details:
## Summary

Browser SSRF policy default allowed private-network navigation.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Browser SSRF protection could allow private-network navigation by default in paths where restrictive behavior was expected, exposing internal services or metadata endpoints through browser-driven requests.

## Technical Details

The fix preserves strict SSRF configuration semantics, keeps private-network access disabled unless explicitly opted in, and updates loopback CDP readiness handling for the stricter default.

## Fix

The issue was fixed in #66354 and #66386. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `024f4614a1a1831406e763adc40ef226e3d5e9ed`
- `1dabfef28db523e7de81edeb3dd689e9171236a2`
- `213c36cf51121ef6c05cfccd78037371f968f31a`
- `7eecfa411df3d12e6b810e6ca5df47254fc3db3f`
- PR: #66354, #66386

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-xq94-r468-qwgj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

Details:
## Summary

Browser SSRF hostname validation could be bypassed by DNS rebinding.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Browser navigation policy could validate a hostname/IP resolution that differed from the address Chromium ultimately used, allowing DNS rebinding style SSRF pivots.

## Technical Details

The fix tightens strict browser hostname navigation so unallowlisted hostname URLs fail closed under restrictive policy.

## Fix

The issue was fixed in #64367. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `121c452d666d4749744dc2089287d0227aae2ed3`
- PR: #64367

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.