CVE-2026-27009

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src 'self'`, no inline scripts).

• CWE-79

• https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7ePatch
• https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1bPatch
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.15Product, Release Notes
• https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6Exploit, Patch, Vendor Advisory

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27002OpenClaw is a personal AI assistant. Prior to version 2026.2…9.8
• CVE-2026-27003OpenClaw is a personal AI assistant. Telegram bot tokens can…5.5
• CVE-2026-27004OpenClaw is a personal AI assistant. Prior to version 2026.2…5.5
• CVE-2026-27005Chartbrew is an open-source web application that can connect…9.8
• CVE-2026-27007OpenClaw is a personal AI assistant. Prior to version 2026.2…3.3
• CVE-2026-27008OpenClaw is a personal AI assistant. Prior to version 2026.2…6.7
• CVE-2026-2701Authenticated user can upload a malicious file to the server…8.8
• CVE-2026-27012OpenSTAManager is an open source management software for tec…9.8
• CVE-2026-27013Fabric.js is a Javascript HTML5 canvas library. Prior to ver…6.1
• CVE-2026-27014NanaZip is an open source file archive Starting in version 5…5.5
• CVE-2026-27015FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-27016LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…5.4