CVE ID: CVE-2026-27007 Severity: Moderate Description: The function in recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when the order changed. In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes could be treated as unchanged and stale containers could be reused. Affected Package/Version: Package: openclaw (npm) Affected versions: =2026.2.15 Remediation: Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing. Fix Commit(s): 41ded303b4f6dae5afa854531ff837c3276ad60b