Read the docs
TI-2026-47177 Aliases CVE-2026-66421GHSA-hc44-65x2-rvc2

OpenClaw Dashboard Stored XSS via lastMessage Session Field

Priority HIGH 71CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00633 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tugcantopalogluopenclaw-dashboard1.1.0 and later—No fix listedCNA
  • openclaw-dashboard Vendortugcantopaloglu Affected 1.1.0 and later Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tugcantopaloglu:openclaw_agent_dashboard:*:*:*:*:*:*:*:*up to 1.1.0Vulnerabletugcantopaloglu
  • cpe:2.3:a:tugcantopaloglu:openclaw_agent_dashboard:*:*:*:*:*:*:*:* Versions up to 1.1.0 Vulnerable ·tugcantopaloglu

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66421
  2. 2026-10-03 Alias added: GHSA-hc44-65x2-rvc2
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

Other 1

  • TI-2026-47175 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences