{"action":"Upgrade openclaw to 2026.2.21 or later.","affected":[{"fixed":"2026.2.21","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-27524"],"ecosystem":"npm","epss":0.00245,"exploited":false,"fixed_versions":["2026.2.21"],"ghsa_id":"GHSA-62f6-mrcj-v8h5","id":"tcs_01M5KF5632308JANZ2YVN2G4K0","modified_at":"2026-03-18T22:01:32.878233Z","published_at":"2026-03-03T22:12:20Z","references":["https://osv.dev/vulnerability/GHSA-62f6-mrcj-v8h5","https://github.com/openclaw/openclaw/security/advisories/GHSA-62f6-mrcj-v8h5","https://nvd.nist.gov/vuln/detail/CVE-2026-27524","https://github.com/openclaw/openclaw/commit/fbb79d4013000552d6a2c23b9613d8b3cb92f6b6","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-prototype-pollution-via-debug-override-path"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-62f6-mrcj-v8h5","url":"https://osv.dev/vulnerability/GHSA-62f6-mrcj-v8h5"},{"source":"nvd","source_id":"CVE-2026-27524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27524"}],"summary":"OpenClaw's runtime /debug override path accepted prototype-reserved keys"}