Openclaw cli: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection (CVE-2026-27009)
Description
OpenClaw CLI versions up to 2026.2.14 are affected by a stored cross-site scripting (XSS) vulnerability in the Control UI. The vulnerability arises from unsanitized assistant identity values (name/avatar) being injected into an inline script tag without proper escaping, allowing script injection. This can lead to execution of attacker-controlled JavaScript in the UI context. The issue is fixed in version 2026.2.15 by removing inline script injection and adding a restrictive Content Security Policy.
CVSS v3.1
Score 5.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw CLI's Control UI improperly injects assistant identity values (name and avatar) into an inline <script> tag using JSON.stringify, which does not prevent the injection of a </script> sequence. This allows an attacker who can set these values to inject arbitrary JavaScript, resulting in stored XSS. The vulnerability affects versions >=2026.1.29 and <2026.2.15. The fix involves serving bootstrap configuration from a JSON endpoint instead of inline scripts and enforcing a strict Content Security Policy that disallows inline scripts.
Potential Impact
An attacker with permission to set assistant identity values can execute arbitrary JavaScript in the Control UI context, potentially stealing tokens or sessions and performing privileged actions within the UI. The Control UI is intended for local use only, so the impact assumes local or loopback access. The CVSS score is 5.8 (medium severity) reflecting local attack vector with high confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
A fix is available in OpenClaw CLI version 2026.2.15 and later. Users should upgrade to this version once released. The fix removes inline script injection and adds a restrictive Content Security Policy to prevent inline scripts. No additional mitigation is required if the patched version is deployed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-27009
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245dd12601ec6a31684cb
Added to database: 10/04/2026, 12:26:05 UTC
Last enriched: 10/04/2026, 13:23:14 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.