CVE-2026-27008

OpenClaw (npm package openclaw) is affected by CVE-2026-27008 prior to version 2026.2.15, where a bug in the download skill installation allowed targetDir values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated, potentially writing files outside th...