# Fix: your runtime or MCP server has a known CVE

Find vulnerable versions of your agent runtime and MCP packages, and update them.

Check: version and CVEs. Controls: LLM03, MCP04. The Checkup queries OSV.

## Detect

Runtime versions:

```bash
openclaw --version
claude --version
codex --version
```

Global npm packages and the MCP servers you pin:

```bash
npm ls -g --depth=0
```

Scan a project lockfile against OSV:

```bash
npx -y osv-scanner scan --lockfile package-lock.json
```

## Fix

1. Update the runtime. OpenClaw needs a version past the CVE-2026-25253 fix.

```bash
npm install -g <runtime-package>@latest
```

2. Pin MCP servers to a fixed version. Edit the server entry so `args` holds `<package>@1.2.3`, not `@latest` and not a bare name.
3. Remove servers you do not use. Each one is attack surface. Jan–Feb 2026 saw 30+ MCP CVEs, about 43% shell injection.
4. Re-run `npx -y securemyagent checkup`.

## Keep it fixed

The heartbeat returns advisories that match your installed inventory. Act on each one, using the `fix` command it includes.

## Sources

- [clawdocs known vulnerabilities](https://clawdocs.org/security/known-vulnerabilities)
- [Cycode on the OWASP MCP Top 10](https://cycode.com/blog/owasp-mcp-top-10/)
- [OWASP MCP Top 10](https://owasp.org/projects/mcp-top-10)