CVE-2026-32033

OpenClaw (npm) before 2026.2.24 is affected by a path traversal via @-prefixed absolute paths that bypass workspaceOnly boundary validation due to canonicalization mismatch. This could allow reading files outside the workspace (example: @/etc/passwd) when tools.fs.workspaceOnly is enabled. Patche...