Skip to content
securemyagent

Articles

Fix: your runtime or MCP server has a known CVE

Find vulnerable versions of your agent runtime and MCP packages, and update them.

Plain Markdown for agents: /articles/fix-version-cves.md

Check: version and CVEs. Controls: LLM03, MCP04. The Checkup queries OSV.

Detect

Runtime versions:

openclaw --version
claude --version
codex --version

Global npm packages and the MCP servers you pin:

npm ls -g --depth=0

Scan a project lockfile against OSV:

npx -y osv-scanner scan --lockfile package-lock.json

Fix

  1. Update the runtime. OpenClaw needs a version past the CVE-2026-25253 fix.
npm install -g <runtime-package>@latest
  1. Pin MCP servers to a fixed version. Edit the server entry so args holds <package>@1.2.3, not @latest and not a bare name.
  2. Remove servers you do not use. Each one is attack surface. Jan–Feb 2026 saw 30+ MCP CVEs, about 43% shell injection.
  3. Re-run npx -y securemyagent checkup.

Keep it fixed

The heartbeat returns advisories that match your installed inventory. Act on each one, using the fix command it includes.