{"data":{"id":"e0c1dd8d-48a8-4285-96c0-ca1d10a12c85","title":"GHSA-xxvh-5hwj-42pp: OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation","summary":"The OpenClaw npm package, versions up to and including 2026.2.14, has a sandbox configuration hash that sorts arrays containing only primitive values. Because of this, order-only changes to sandbox arrays such as Docker `dns` and `binds` hash identically, so the hash can wrongly signal that existing containers are unchanged and stale containers get reused. The patch is planned for version 2026.2.15 and later.","solution":"Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing. Fixed in commit 41ded303b4f6dae5afa854531ff837c3276ad60b. Upgrade to 2026.2.15 or later.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-xxvh-5hwj-42pp","publishedAt":"2026-02-18T22:44:10.000Z","cveId":"CVE-2026-27007","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.2.15 (fixed: 2026.2.15)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00177,"epssCheckedAt":"2026-11-04T18:09:14.312Z","kevDateAdded":null,"advisoryAliases":["GHSA-xxvh-5hwj-42pp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-16T03:56:42.422Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:40:50.252Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.15","matchedVersion":"2026.2.15","fixReleasedAt":"2026-02-16T03:56:42.422Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:50.105Z"}]}}