N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-62f6-mrcj-v8h5

GHSA-62f6-mrcj-v8h5: OpenClaw's runtime /debug override path accepted prototype-reserved keys

Summary

OpenClaw accepted prototype-reserved keys in runtime /debug set override object values (__proto__, constructor, prototype).

Impact

/debug is disabled by default, and exploitation requires an already authorized /debug set caller. No unauthenticated vector was identified.

This issue affects runtime in-memory overrides only (non-persistent and cleared on restart/reset). Given the required prior authorization boundary, this is treated as defense-in-depth hardening for command flag evaluation.

Affected Packages / Versions

Package: openclaw (npm)
Latest published vulnerable version confirmed: 2026.2.19-2
Vulnerable range: <= 2026.2.19-2
Patched in planned next release: 2026.2.21

Technical Details

Runtime override merges now block reserved prototype keys during deep merge.
Runtime override writes now sanitize nested object values to remove reserved prototype keys before storing overrides.
Restricted command gates (bash, config, debug) now require own-property boolean flags, preventing inherited prototype values from enabling commands.

Fix Commit(s)

fbb79d4013000552d6a2c23b9613d8b3cb92f6b6

Release Process Note

patched_versions is pre-set to 2026.2.21 so after the npm release is live, this advisory can be published immediately.

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-62f6-mrcj-v8h5

GHSA-62f6-mrcj-v8h5:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.21	2026.2.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of prototype pollution in a JavaScript/TypeScript application. It stems from two primary weaknesses that were addressed in the patch:

Unsanitized Input in Configuration Overrides: The setConfigOverride function in src/config/runtime-overrides.ts accepted user-provided data for runtime configuration changes (specifically via the /debug set command) without sanitizing it. This allowed an attacker with the necessary privileges to inject objects containing malicious keys like __proto__, constructor, or prototype.
Unsafe Property Access for Feature Flags: Multiple functions throughout the codebase checked if a command or feature was enabled by directly accessing properties on the configuration object (e.g., cfg.commands.bash === true). When the object's prototype is polluted, these checks can be bypassed because the property will be found on the shared Object.prototype and resolve to true.

The exploitation path would be for an authorized user to call /debug set with a specially crafted JSON payload that pollutes the prototype of all JavaScript objects. For example, {"__proto__":{"bash":true}}. This would globally enable the bash command flag.

The fix is comprehensive:

It introduces a sanitizeOverrideValue function that recursively strips out forbidden keys from any object being set as a runtime override. This is applied in setConfigOverride.
It adds a blocklist to the mergeOverrides function to prevent these keys from being merged, as a defense-in-depth measure.
It replaces all unsafe direct property checks for command flags with a new isCommandFlagEnabled utility. This new function uses Object.hasOwn to ensure it only checks for properties on the object itself, ignoring the prototype chain, thus preventing the bypass.

Vulnerable functions

setConfigOverride

src/config/runtime-overrides.ts

This function was vulnerable because it did not sanitize the `value` before setting it as a configuration override, allowing an attacker to inject a malicious payload with prototype-polluting keys like `__proto__`. The patch introduces `sanitizeOverrideValue` to clean the input.

mergeOverrides

src/config/runtime-overrides.ts

This function was responsible for merging configuration overrides. It was vulnerable because it did not check for and block prototype-polluting keys (`__proto__`, `constructor`, `prototype`) during the merge process, allowing a polluted override to be merged into the application's configuration.

isCommandEnabled

src/auto-reply/commands-registry.ts

This function checked if a command was enabled by directly accessing properties on the configuration object (e.g., `cfg.commands?.config`). This is unsafe because a prototype pollution attack could make this check return `true` for a disabled command by modifying `Object.prototype`. The patch changes this to use `isCommandFlagEnabled`, which performs a safe `hasOwnProperty` check.

handleBashChatCommand

src/auto-reply/reply/bash-command.ts

This function, which handles the `/bash` command, was vulnerable because it checked for command enablement via direct property access (`params.cfg.commands?.bash`). This could be bypassed using a prototype pollution attack. The fix uses the safe `isCommandFlagEnabled` function.

handleAllowlistCommand

src/auto-reply/reply/commands-allowlist.ts

This function for the `/allowlist` command used an unsafe check (`params.cfg.commands?.config`) to determine if the command was enabled, making it vulnerable to prototype pollution. The patch replaces this with a call to the secure `isCommandFlagEnabled` function.

handleConfigCommand

src/auto-reply/reply/commands-config.ts

The handler for the `/config` command was vulnerable to prototype pollution because it used a direct property access (`params.cfg.commands?.config`) to check if the command was enabled. The fix involves using the `isCommandFlagEnabled` function for a secure check.

handleDebugCommand

src/auto-reply/reply/commands-config.ts

The handler for the `/debug` command, which is central to this vulnerability, used an unsafe property access (`params.cfg.commands?.debug`) to check for its enablement. This could be bypassed via prototype pollution. The patch mitigates this by using the `isCommandFlagEnabled` function.

isRestartEnabled

src/config/commands.ts

This function was vulnerable as it checked the `restart` flag using direct property access (`config?.commands?.restart`), which could be manipulated through prototype pollution. The patch refactors it to use `getOwnCommandFlagValue`, which performs a safe `hasOwnProperty` check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-62f6-mrcj-v8h5: OpenClaw's runtime /debug override path accepted prototype-reserved keys

Summary

Impact

Affected Packages / Versions

Technical Details

Fix Commit(s)

Release Process Note

GHSA-62f6-mrcj-v8h5:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-62f6-mrcj-v8h5: OpenClaw's runtime /debug override path accepted prototype-reserved keys

Summary

Impact

Affected Packages / Versions

Technical Details

Fix Commit(s)

Release Process Note

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI