CVE-2026-108722

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108722
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108722.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108722
Published
2026-10-11T12:19:32Z
Modified
2026-10-14T10:46:43Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
Details

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108722.json"
}
References

Affected packages

Git / github.com/e2b-dev/open-computer-use

Affected ranges

Type
GIT
Repo
https://github.com/e2b-dev/open-computer-use
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
610bac85d242b2fdf43fbe36bce2348658a2d4c9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108722.json"