Junglewise Threat Intelligence

CVE-2026-27009: OpenClaw stored XSS in Control UI via unsanitized assistant identity

CVE-2026-27009 · Severity: low · CVSS 3.1 · Published 2026-02-18

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw's Control UI is a web-based administration interface for managing AI agents and assistants. A vulnerability allows attackers who can set assistant name or avatar values to inject malicious JavaScript that executes when administrators access the Control UI, potentially stealing session tokens or performing unauthorized actions. The impact is limited by OpenClaw's design as a local-only tool, but administrators could be compromised if the interface is exposed.

Technical details

The vulnerability is a stored Cross-Site Scripting (CWE-79) flaw in OpenClaw's Control UI gateway. The application injected assistantName and assistantAvatar values directly into an inline <script> block using JSON.stringify(), which does not prevent </script> sequences from terminating the script element. An attacker with permissions to set assistant identity values (via config or agent identity) can craft a payload containing </script><script> to break out of the context and execute arbitrary JavaScript in the Control UI origin. Attack requires local network access or exposed deployment; no authentication bypass is needed if the UI is accessible. The fix (version 2026.2.15+) removes inline script injection, serves bootstrap config via a JSON endpoint, and implements a restrictive Content Security Policy (script-src 'self', no inline scripts).

Affected products

  • OpenClaw openclaw <= 2026.2.14

Timeline

  • 2026-02-18: disclosed: Advisory published on GitHub (GHSA-37gc-85xm-2ww6)
  • 2026-02-15: patched: Fix merged to main branch; patched version 2026.2.15+ available

References

Related threats