CVE-2026-66421

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

CVE-2026-66421

The CVE-2026-66421 entry documents a stored cross-site scripting vulnerability in OpenClaw Dashboard. The issue arises from processing agent transcript messages via the sessions API, where attacker-supplied HTML markup (for example, an inline event handler in an img tag) can be stored in a sessio...

CVE-2026-66421 OpenClaw Dashboard Stored XSS via lastMessage Session Field

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

CVE-2026-66421 OpenClaw Dashboard Stored XSS via lastMessage Session Field

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

CVE-2026-66418

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

EUVD-2026-51309

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66418

OpenClaw Dashboard v3.0.0 is affected by a stored XSS in the login failure path. An unauthenticated attacker can submit a crafted username, which is recorded in the audit log and later rendered unescaped via innerHTML in the administrator notification panel. The permissive CSP (allowing inline ev...

PT-2026-66598

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...

PT-2026-66628

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard affected versions not specified Description A stored cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in an administrator's browser session. This occurs when HTML...