CVE-2026-100597

The OpenClaw npm package (openclaw ) prior to version 2026.7.1 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition within OpenShell local mirror filesystem mutation operations. Specifically, the remove, mkdir, and rename operations may target a different filesystem path if the pa...

EUVD-2026-87454

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...