CVE-2026-66421 is a stored cross-site scripting vulnerability in openclaw-dashboard 1.1.0. Attackers can inject HTML markup with inline event handlers (e.g., an img tag with an onerror attribute) into agent transcript messages within a 60-character rendering budget. These messages are stored in session transcripts and interpolated unsanitized into innerHTML on the default landing page, enabling execution of arbitrary JavaScript in the administrator's browser session. This can result in session token theft and unauthorized calls to authenticated administrative endpoints, including modification of agent instruction files.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session. This can lead to theft of session tokens and unauthorized administrative actions such as modifying agent instruction files, potentially compromising the integrity and security of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the affected system and monitor for suspicious activity related to session manipulation.