CVE-2026-27524
CVE-2026-27524 · OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authorized /debug set callers can inject __proto__, constructor, or prototype keys to manipulate object prototypes and bypass command gate restrictions.
CVSS 2.3 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node