CVE-2026-108722: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in e2b-dev open-computer-use

The vulnerability CVE-2026-108722 affects the open-computer-use software by e2b-dev. It is a stored cross-site scripting issue caused by improper neutralization of input during web page generation. Specifically, the Logger.write_log_file function writes transcript text directly into an HTML log file without escaping HTML characters, enabling injection of malicious scripts. Attackers who can influence sandbox content that appears in run_command output can exploit this to execute scripts in the context of the operator viewing the log, leading to potential exfiltration of transcript data. There is no indication of known exploits in the wild or cloud service involvement.

Successful exploitation allows attackers to inject and execute arbitrary scripts in the context of the operator viewing the log.html file. This can lead to exfiltration of sensitive transcript contents from the logs. However, the overall impact is limited by the requirement that attackers must control sandbox content displayed in run_command output and that operators must open the affected log file. The CVSS score of 2.3 reflects the low severity and limited attack vector.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening log files generated by Logger.write_log_file if untrusted sandbox content might be present. Applying HTML escaping to transcript text before writing to log.html would mitigate this vulnerability.