What is GHSA-h89v-j3x9-8wqj?

GHSA-h89v-j3x9-8wqj is a security advisory published by GitHub Security Advisories with Medium severity. OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

Which CVE IDs does GHSA-h89v-j3x9-8wqj cover?

GHSA-h89v-j3x9-8wqj covers the following CVE IDs: CVE-2026-28452. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h89v-j3x9-8wqj?

GHSA-h89v-j3x9-8wqj has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-h89v-j3x9-8wqj?

GHSA-h89v-j3x9-8wqj affects 2 products, including: npm/openclaw:\u003c 2026.2.14; npm/clawdbot:\u003c= 2026.1.24-3.

GHSA-h89v-j3x9-8wqjMediumCVSS 6.5

OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

Vendor

GitHub Security Advisories

Published

February 18, 2026

Last Modified

March 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-28452 →

📋 Description

Summary

Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

Affected Packages / Versions

openclaw (npm): <= 2026.2.13
clawdbot (npm): <= 2026.1.24-3

Details

Affected component: src/infra/archive.ts (extractArchive).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

Fix Commit(s)

openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c365611165423cb71
openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

Release Process Note

This advisory will be updated with patched versions once the next npm release containing the fix is published.