5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27009

CVE-2026-27009: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Summary

Stored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline <script> tag without script-context-safe escaping. A crafted value containing </script> could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.14
Fixed in: >= 2026.2.15 (next release; fix is already merged on main)

Details

The gateway Control UI HTML response previously injected assistantName and assistantAvatar directly into an inline <script> block using JSON.stringify(...). JSON.stringify does not prevent </script> from terminating the script element, enabling stored XSS if an operator/admin sets the assistant identity to a malicious string.

OpenClaw’s Control UI is intended for local use only (see SECURITY.md); this advisory’s CVSS reflects a loopback-only/local-access deployment assumption.

Impact

An attacker with the ability to set assistant identity values (config or agent identity) could cause JavaScript execution for Control UI visitors, enabling token/session theft and privileged actions in the UI.

Fix

Removed inline script injection and serve bootstrap config from a JSON endpoint.
Added a restrictive Content Security Policy for the Control UI (script-src 'self', no inline scripts).

Fix Commit(s)

adc818db4a4b3b8d663e7674ef20436947514e1b
3b4096e02e7e335f99f5986ec1bd566e90b14a7e

Release Process Note

This advisory pre-sets the patched version to the planned next release (). Once that version is published to npm, this advisory can be published without further edits.

Miggo Vulnerability Database

→

CVE-2026-27009

CVE-2026-27009:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.15	2026.2.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) flaw within the OpenClaw Control UI. The root cause lies in the server-side rendering of the main HTML page, where configuration data (assistant name and avatar) was injected directly into an inline <script> block. The developers used JSON.stringify to serialize this data, which is unsafe for embedding within a script context because it does not escape HTML-like syntax, specifically the </script> tag.

An attacker with privileges to modify the assistant's identity could set the name to a malicious payload such as a\";</script><script>alert('XSS');//. When the Control UI page was rendered for a user, this payload would prematurely close the legitimate script tag and allow the attacker's script to execute with the full permissions of the UI's origin, leading to potential session theft or unauthorized actions.

The analysis of the provided patch commits confirms this. Commit adc818db4a4b3b8d663e7674ef20436947514e1b shows the complete removal of the server-side function injectControlUiConfig from src/gateway/control-ui.ts, which was the function that created the vulnerable script string. The calling function, serveIndexHtml, and the main request handler, handleControlUiHttpRequest, were modified to stop this injection practice. Instead, the fix implements a safer pattern: the configuration is now served from a separate JSON endpoint (/__openclaw/control-ui-config.json), and the client-side code (as seen in commit 3b4096e02e7e335f99f5986ec1bd566e90b14a7e) fetches this data asynchronously. This completely decouples the data from the HTML rendering and mitigates the XSS risk. Additionally, a stricter Content Security Policy (script-src 'self') was added as a defense-in-depth measure to block inline scripts altogether.

Vulnerable functions

injectControlUiConfig

src/gateway/control-ui.ts

This function is directly responsible for the XSS vulnerability. It constructs an inline `<script>` tag by concatenating strings, including the `assistantName` and `assistantAvatar`. These values are wrapped in `JSON.stringify`, which does not escape the `</script>` substring. This allows an attacker who can control the assistant identity to break out of the script block and inject arbitrary JavaScript.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27009: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Summary

Affected Packages / Versions

Details

Impact

Fix

Fix Commit(s)

Release Process Note

CVE-2026-27009:

5.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

5.8

5.8

CVE-2026-27009: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Summary

Affected Packages / Versions

Details

Impact

Fix

Fix Commit(s)

Release Process Note

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI