Threat Intelligence Database

OpenClaw Dashboard version 1.1.0 contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated remote attackers to inject malicious JavaScript into the administrator's browser session. This occurs via HTML markup injected into agent transcript messages processed through the sessions API, which is then unsanitized and rendered on the default landing page. Exploitation can lead to theft of session tokens and unauthorized administrative actions, including modification of agent instruction files.

OpenClaw Dashboard version 3.0.0 contains a stored cross-site scripting (XSS) vulnerability. An unauthenticated attacker can submit a crafted username in a failed login POST request, which is logged without proper escaping. When an administrator views the notification panel, the malicious script executes in their session due to a permissive Content-Security-Policy allowing inline event handlers. This enables the attacker to interact with authenticated administrative functions such as editing agent instruction files and changing configurations.