Executive brief
OpenClaw Dashboard, a monitoring tool for AI agents, contains a security flaw that allows unauthorized outsiders to run malicious code in an administrator's browser. By sending a specially crafted message to an AI agent (for example, via a public chat or webhook), an attacker can inject hidden commands that are later triggered when an administrator views the dashboard. This could lead to the theft of login tokens, unauthorized access to sensitive data, or the modification of agent instructions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in OpenClaw Dashboard due to the improper neutralization of agent transcript messages. The application processes these messages through a sessions API and renders the 'last message' field on the default landing page using the 'innerHTML' property without sanitization. An unauthenticated attacker can send a message containing a compact HTML payload (e.g., an <img> tag with an 'onerror' attribute) that fits within the 60-character rendering budget. When an administrator views the dashboard, the payload executes, potentially allowing session token theft and unauthorized administrative actions such as modifying agent instruction files. As of the advisory date, no patch is available.
Affected products
- tugcantopaloglu openclaw-dashboard <= 1.1.0
Timeline
- 2026-07-30: disclosed: Vulnerability published by VulnCheck and NVD