CVE-2026-27524

OpenClaw before version 2026.2.21 is vulnerable to prototype pollution via the runtime /debug set override path. Authorized /debug set callers can inject critical keys (proto , constructor, prototype) to modify object prototypes and bypass command gate restrictions, as described across CVE-2026-2...