CVE-2026-27009

Stored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline <script> tag without script-context-safe escaping. A crafted value containing </script> could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin.

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.2.14
• Fixed in: >= 2026.2.15 (next release; fix is already merged on main)

Details

The gateway Control UI HTML response previously injected assistantName and assistantAvatar directly into an inline <script> block using JSON.stringify(...). JSON.stringify does not prevent </script> from terminating the script element, enabling stored XSS if an operator/admin sets the assistant identity to a malicious string.

OpenClaw’s Control UI is intended for local use only (see SECURITY.md); this advisory’s CVSS reflects a loopback-only/local-access deployment assumption.

Fix Commit(s)

• adc818db4a4b3b8d663e7674ef20436947514e1b
• 3b4096e02e7e335f99f5986ec1bd566e90b14a7e

Release Process Note

This advisory pre-sets the patched version to the planned next release (2026.2.15). Once that version is published to npm, this advisory can be published without further edits.

Thanks @Adam55A-code for reporting.

An attacker with the ability to set assistant identity values (config or agent identity) could cause JavaScript execution for Control UI visitors, enabling token/session theft and privileged actions in the UI.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-27009 has a CVSS score of 5.8 (Medium). The vector is requires local access, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2026.2.15); upgrading removes the vulnerable code path.

Kodem intelligence

• Removed inline script injection and serve bootstrap config from a JSON endpoint.
• Added a restrictive Content Security Policy for the Control UI (script-src 'self', no inline scripts).

1. What is CVE-2026-27009? CVE-2026-27009 is a medium-severity cross-site scripting (XSS) vulnerability in openclaw (npm), affecting versions < 2026.2.15. It is fixed in 2026.2.15. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-27009? CVE-2026-27009 has a CVSS score of 5.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of openclaw are affected by CVE-2026-27009? openclaw (npm) versions < 2026.2.15 is affected.
4. Is there a fix for CVE-2026-27009? Yes. CVE-2026-27009 is fixed in 2026.2.15. Upgrade to this version or later.
5. Is CVE-2026-27009 exploitable, and should I be worried? Whether CVE-2026-27009 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-27009 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-27009? Upgrade openclaw to 2026.2.15 or later.