Vulnerability-Lookup

CVE-2026-27009 (GCVE-0-2026-27009)

Vulnerability from cvelistv5 – Published: 2026-02-19 23:25 – Updated: 2026-02-20 15:36

Title

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Summary

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src 'self'`, no inline scripts).

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/openclaw/openclaw/security/adv…	x_refsource_CONFIRM
https://github.com/openclaw/openclaw/commit/3b409…	x_refsource_MISC
https://github.com/openclaw/openclaw/commit/adc81…	x_refsource_MISC
https://github.com/openclaw/openclaw/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
openclaw	openclaw	Affected: < 2026.2.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27009",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T15:29:24.166626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:36:57.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openclaw",
          "vendor": "openclaw",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2026.2.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `\u003cscript\u003e` tag without script-context-safe escaping. A crafted value containing `\u003c/script\u003e` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src \u0027self\u0027`, no inline scripts)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T23:25:41.111Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6"
        },
        {
          "name": "https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e"
        },
        {
          "name": "https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b"
        },
        {
          "name": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.15"
        }
      ],
      "source": {
        "advisory": "GHSA-37gc-85xm-2ww6",
        "discovery": "UNKNOWN"
      },
      "title": "OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27009",
    "datePublished": "2026-02-19T23:25:41.111Z",
    "dateReserved": "2026-02-17T03:08:23.489Z",
    "dateUpdated": "2026-02-20T15:36:57.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-27009",
      "date": "2026-07-10",
      "epss": "0.00228",
      "percentile": "0.13582"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-27009\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-20T00:16:17.620\",\"lastModified\":\"2026-06-17T10:26:31.890\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `\u003cscript\u003e` tag without script-context-safe escaping. A crafted value containing `\u003c/script\u003e` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src \u0027self\u0027`, no inline scripts).\"},{\"lang\":\"es\",\"value\":\"OpenClaw es un asistente personal de IA. Antes de la versi\u00f3n 2026.2.15, exist\u00eda un problema de XSS almacenado en la interfaz de usuario de control de OpenClaw al renderizar la identidad del asistente (nombre/avatar) en una etiqueta `` podr\u00eda escapar de la etiqueta de script y ejecutar JavaScript controlado por el atacante en el origen de la interfaz de usuario de control. La versi\u00f3n 2026.2.15 elimin\u00f3 la inyecci\u00f3n de scripts en l\u00ednea y sirve la configuraci\u00f3n de arranque desde un endpoint JSON, y a\u00f1adi\u00f3 una Pol\u00edtica de Seguridad de Contenido restrictiva para la interfaz de usuario de control (`script-src \u0027self\u0027`, sin scripts en l\u00ednea).\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"openclaw\",\"product\":\"openclaw\",\"versions\":[{\"version\":\"\u003c 2026.2.15\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.6,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-20T15:29:24.166626Z\",\"id\":\"CVE-2026-27009\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"2026.2.15\",\"matchCriteriaId\":\"3CD9AC99-DDDF-4177-9253-04A63CA027DC\"}]}]}],\"references\":[{\"url\":\"https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openclaw/openclaw/releases/tag/v2026.2.15\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-02-21T01:30:36+00:00",
      "cve": "CVE-2026-27009",
      "id": "CVE-2026-27009",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27009.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-27009\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-20T15:29:24.166626Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-20T15:29:25.780Z\"}}], \"cna\": {\"title\": \"OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection\", \"source\": {\"advisory\": \"GHSA-37gc-85xm-2ww6\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"openclaw\", \"product\": \"openclaw\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2026.2.15\"}]}], \"references\": [{\"url\": \"https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6\", \"name\": \"https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e\", \"name\": \"https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b\", \"name\": \"https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/openclaw/openclaw/releases/tag/v2026.2.15\", \"name\": \"https://github.com/openclaw/openclaw/releases/tag/v2026.2.15\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `\u003cscript\u003e` tag without script-context-safe escaping. A crafted value containing `\u003c/script\u003e` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src \u0027self\u0027`, no inline scripts).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-19T23:25:41.111Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-27009\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-20T15:36:57.938Z\", \"dateReserved\": \"2026-02-17T03:08:23.489Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-19T23:25:41.111Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2026-13425

Vulnerability from cnvd - Published: 2026-03-12

Title

OpenClaw跨站脚本漏洞

Description

OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw存在跨站脚本漏洞。该漏洞源于Control UI渲染助手身份信息时转义不当，攻击者可利用该漏洞控制JavaScript。

Severity

中

Patch Name

OpenClaw跨站脚本漏洞的补丁

Patch Description

OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw存在跨站脚本漏洞。该漏洞源于Control UI渲染助手身份信息时转义不当，攻击者可利用该漏洞控制JavaScript。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/openclaw/openclaw/releases

Reference

https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e

Impacted products

Name
OpenClaw OpenClaw <2026.2.15

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-27009",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-27009"
    }
  },
  "description": "OpenClaw\u662fOpenClaw\u5f00\u6e90\u7684\u4e00\u4e2a\u667a\u80fd\u4eba\u5de5\u52a9\u7406\u3002\n\nOpenClaw\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eControl UI\u6e32\u67d3\u52a9\u624b\u8eab\u4efd\u4fe1\u606f\u65f6\u8f6c\u4e49\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236JavaScript\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/openclaw/openclaw/releases",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-13425",
  "openTime": "2026-03-12",
  "patchDescription": "OpenClaw\u662fOpenClaw\u5f00\u6e90\u7684\u4e00\u4e2a\u667a\u80fd\u4eba\u5de5\u52a9\u7406\u3002\r\n\r\nOpenClaw\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eControl UI\u6e32\u67d3\u52a9\u624b\u8eab\u4efd\u4fe1\u606f\u65f6\u8f6c\u4e49\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236JavaScript\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "OpenClaw\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "OpenClaw OpenClaw \u003c2026.2.15"
  },
  "referenceLink": "https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e",
  "serverity": "\u4e2d",
  "submitTime": "2026-03-02",
  "title": "OpenClaw\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

FKIE_CVE-2026-27009

Vulnerability from fkie_nvd - Published: 2026-02-20 00:16 - Updated: 2026-06-17 10:26

Severity

5.8 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e	Patch
security-advisories@github.com	https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b	Patch
security-advisories@github.com	https://github.com/openclaw/openclaw/releases/tag/v2026.2.15	Product, Release Notes
security-advisories@github.com	https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6	Exploit, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	openclaw	openclaw	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openclaw",
          "vendor": "openclaw",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2026.2.15"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "3CD9AC99-DDDF-4177-9253-04A63CA027DC",
              "versionEndExcluding": "2026.2.15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `\u003cscript\u003e` tag without script-context-safe escaping. A crafted value containing `\u003c/script\u003e` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src \u0027self\u0027`, no inline scripts)."
    },
    {
      "lang": "es",
      "value": "OpenClaw es un asistente personal de IA. Antes de la versi\u00f3n 2026.2.15, exist\u00eda un problema de XSS almacenado en la interfaz de usuario de control de OpenClaw al renderizar la identidad del asistente (nombre/avatar) en una etiqueta `` podr\u00eda escapar de la etiqueta de script y ejecutar JavaScript controlado por el atacante en el origen de la interfaz de usuario de control. La versi\u00f3n 2026.2.15 elimin\u00f3 la inyecci\u00f3n de scripts en l\u00ednea y sirve la configuraci\u00f3n de arranque desde un endpoint JSON, y a\u00f1adi\u00f3 una Pol\u00edtica de Seguridad de Contenido restrictiva para la interfaz de usuario de control (`script-src \u0027self\u0027`, sin scripts en l\u00ednea)."
    }
  ],
  "id": "CVE-2026-27009",
  "lastModified": "2026-06-17T10:26:31.890",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.6,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27009",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-02-20T15:29:24.166626Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-02-20T00:16:17.620",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.15"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-37GC-85XM-2WW6

Vulnerability from github – Published: 2026-02-18 22:44 – Updated: 2026-02-20 16:47

Summary

OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Details

Summary

Stored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline <script> tag without script-context-safe escaping. A crafted value containing </script> could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.14
Fixed in: >= 2026.2.15 (next release; fix is already merged on main)

Details

The gateway Control UI HTML response previously injected assistantName and assistantAvatar directly into an inline <script> block using JSON.stringify(...). JSON.stringify does not prevent </script> from terminating the script element, enabling stored XSS if an operator/admin sets the assistant identity to a malicious string.

OpenClaw’s Control UI is intended for local use only (see SECURITY.md); this advisory’s CVSS reflects a loopback-only/local-access deployment assumption.

Impact

An attacker with the ability to set assistant identity values (config or agent identity) could cause JavaScript execution for Control UI visitors, enabling token/session theft and privileged actions in the UI.

Fix

Removed inline script injection and serve bootstrap config from a JSON endpoint.
Added a restrictive Content Security Policy for the Control UI (script-src 'self', no inline scripts).

Fix Commit(s)

adc818db4a4b3b8d663e7674ef20436947514e1b
3b4096e02e7e335f99f5986ec1bd566e90b14a7e

Release Process Note

This advisory pre-sets the patched version to the planned next release (2026.2.15). Once that version is published to npm, this advisory can be published without further edits.

Thanks @Adam55A-code for reporting.

Severity

5.8 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T22:44:33Z",
    "nvd_published_at": "2026-02-20T00:16:17Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nStored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `\u003cscript\u003e` tag without script-context-safe escaping. A crafted value containing `\u003c/script\u003e` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.14`\n- Fixed in: `\u003e= 2026.2.15` (next release; fix is already merged on `main`)\n\n## Details\nThe gateway Control UI HTML response previously injected `assistantName` and `assistantAvatar` directly into an inline `\u003cscript\u003e` block using `JSON.stringify(...)`. `JSON.stringify` does not prevent `\u003c/script\u003e` from terminating the script element, enabling stored XSS if an operator/admin sets the assistant identity to a malicious string.\n\nOpenClaw\u2019s Control UI is intended for local use only (see `SECURITY.md`); this advisory\u2019s CVSS reflects a loopback-only/local-access deployment assumption.\n\n## Impact\nAn attacker with the ability to set assistant identity values (config or agent identity) could cause JavaScript execution for Control UI visitors, enabling token/session theft and privileged actions in the UI.\n\n## Fix\n- Removed inline script injection and serve bootstrap config from a JSON endpoint.\n- Added a restrictive Content Security Policy for the Control UI (`script-src \u0027self\u0027`, no inline scripts).\n\n## Fix Commit(s)\n- `adc818db4a4b3b8d663e7674ef20436947514e1b`\n- `3b4096e02e7e335f99f5986ec1bd566e90b14a7e`\n\n## Release Process Note\nThis advisory pre-sets the patched version to the planned next release (`2026.2.15`). Once that version is published to npm, this advisory can be published without further edits.\n\nThanks @Adam55A-code for reporting.",
  "id": "GHSA-37gc-85xm-2ww6",
  "modified": "2026-02-20T16:47:40Z",
  "published": "2026-02-18T22:44:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27009"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection"
}

WID-SEC-W-2026-0459

Vulnerability from csaf_certbund - Published: 2026-02-18 23:00 - Updated: 2026-02-18 23:00

Summary

OpenClaw: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: OpenClaw ist ein persönlicher KI-Assistent zur Ausführung auf eigenen Geräten.

Angriff: Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, Rechte zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-27001

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenClaw <2026.2.15 Open Source / OpenClaw		<2026.2.15

CVE-2026-27002

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenClaw <2026.2.15 Open Source / OpenClaw		<2026.2.15

CVE-2026-27003

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenClaw <2026.2.15 Open Source / OpenClaw		<2026.2.15

CVE-2026-27007

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenClaw <2026.2.15 Open Source / OpenClaw		<2026.2.15

CVE-2026-27008

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenClaw <2026.2.15 Open Source / OpenClaw		<2026.2.15

CVE-2026-27009

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source OpenClaw <2026.2.15 Open Source / OpenClaw		<2026.2.15

References

8 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/advisories/GHSA-2qj5-gwg2-xwc4	external
https://github.com/advisories/GHSA-37gc-85xm-2ww6	external
https://github.com/advisories/GHSA-chf7-jq6g-qrwv	external
https://github.com/advisories/GHSA-h7f7-89mm-pqh6	external
https://github.com/advisories/GHSA-w235-x559-36mg	external
https://github.com/advisories/GHSA-xxvh-5hwj-42pp	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "OpenClaw ist ein pers\u00f6nlicher KI-Assistent zur Ausf\u00fchrung auf eigenen Ger\u00e4ten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein  Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Rechte zu erweitern, Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuf\u00fchren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0459 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0459.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0459 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0459"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-02-18",
        "url": "https://github.com/advisories/GHSA-2qj5-gwg2-xwc4"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-02-18",
        "url": "https://github.com/advisories/GHSA-37gc-85xm-2ww6"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-02-18",
        "url": "https://github.com/advisories/GHSA-chf7-jq6g-qrwv"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-02-18",
        "url": "https://github.com/advisories/GHSA-h7f7-89mm-pqh6"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-02-18",
        "url": "https://github.com/advisories/GHSA-w235-x559-36mg"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-02-18",
        "url": "https://github.com/advisories/GHSA-xxvh-5hwj-42pp"
      }
    ],
    "source_lang": "en-US",
    "title": "OpenClaw: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-02-18T23:00:00.000+00:00",
      "generator": {
        "date": "2026-02-19T11:48:48.987+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0459",
      "initial_release_date": "2026-02-18T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-02-18T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2026.2.15",
                "product": {
                  "name": "Open Source OpenClaw \u003c2026.2.15",
                  "product_id": "T051023"
                }
              },
              {
                "category": "product_version",
                "name": "2026.2.15",
                "product": {
                  "name": "Open Source OpenClaw 2026.2.15",
                  "product_id": "T051023-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openclaw:openclaw:2026.2.15"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenClaw"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27001",
      "product_status": {
        "known_affected": [
          "T051023"
        ]
      },
      "release_date": "2026-02-18T23:00:00.000+00:00",
      "title": "CVE-2026-27001"
    },
    {
      "cve": "CVE-2026-27002",
      "product_status": {
        "known_affected": [
          "T051023"
        ]
      },
      "release_date": "2026-02-18T23:00:00.000+00:00",
      "title": "CVE-2026-27002"
    },
    {
      "cve": "CVE-2026-27003",
      "product_status": {
        "known_affected": [
          "T051023"
        ]
      },
      "release_date": "2026-02-18T23:00:00.000+00:00",
      "title": "CVE-2026-27003"
    },
    {
      "cve": "CVE-2026-27007",
      "product_status": {
        "known_affected": [
          "T051023"
        ]
      },
      "release_date": "2026-02-18T23:00:00.000+00:00",
      "title": "CVE-2026-27007"
    },
    {
      "cve": "CVE-2026-27008",
      "product_status": {
        "known_affected": [
          "T051023"
        ]
      },
      "release_date": "2026-02-18T23:00:00.000+00:00",
      "title": "CVE-2026-27008"
    },
    {
      "cve": "CVE-2026-27009",
      "product_status": {
        "known_affected": [
          "T051023"
        ]
      },
      "release_date": "2026-02-18T23:00:00.000+00:00",
      "title": "CVE-2026-27009"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-27009 (GCVE-0-2026-27009)

CNVD-2026-13425

FKIE_CVE-2026-27009

GHSA-37GC-85XM-2WW6

Summary

Affected Packages / Versions

Details

Impact

Fix

Fix Commit(s)

Release Process Note

WID-SEC-W-2026-0459

Tags

Sightings

Nomenclature