CVE-2026-27009: OpenClaw Stored XSS Vulnerability in Control UI via Unsanitized Assistant Name/Avatar
Summary
CVE-2026-27009: Stored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline tag without script-context-safe escaping. Affects openclaw versions < 2026.2.15. Fixed in 2026.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source software package designed for managing and controlling various applications through a user-friendly interface. It allows operators and administrators to set up assistants with specific identities, including names and avatars. However, a critical vulnerability has been identified in the Control UI, where unsanitized input can lead to stored cross-site scripting (XSS) attacks, compromising the security of the application.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the OpenClaw Control UI. Specifically, the assistant's identity, including the name and avatar, is rendered directly into an inline script tag without adequate escaping. This allows an attacker to inject malicious JavaScript code by setting the assistant identity to a crafted value containing '</script>'. When this code is executed in the browser, it can lead to unauthorized actions, session theft, and other malicious activities. The vulnerability is classified as moderate with a CVSS score of 5.8, indicating a significant risk, especially in environments where the Control UI is accessible.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.15
This is the first release that contains the fix.
npm install openclaw@2026.2.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid setting the assistant identity to any untrusted or malicious strings. Additionally, implementing a strict Content Security Policy (CSP) can help mitigate the risk by disallowing inline scripts. A sample CSP header could be: Content-Security-Policy: script-src 'self';
Conclusion
The stored XSS vulnerability in OpenClaw's Control UI poses a significant risk to users who can set assistant identities. It is crucial to update to the patched version 2026.2.15 to mitigate this risk. Users should also consider implementing additional security measures such as Content Security Policies to further protect their applications.
See every vulnerability recorded for openclaw →
FAQ
An attacker could execute arbitrary JavaScript in the Control UI, potentially leading to token theft and unauthorized actions.
You can use Vulert's playground at Vulert Scanner to monitor and check for vulnerabilities in your application without needing to sign up.
If updating is not possible, ensure that you do not allow untrusted input for assistant identities and consider implementing a strict Content Security Policy.
Yes, the advisory notes that the vulnerability is primarily a concern for local deployments, as the Control UI is intended for local use only.
The CVSS score for this vulnerability is 5.8, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
