CVE-2026-66421

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-66421

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66421.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-66421

Published

2026-07-30T22:16:58Z

Modified

2026-09-05T03:48:03Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

OpenClaw Dashboard Stored XSS via lastMessage Session Field

Details

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66421.json"
}

References

Affected packages

Git / github.com/tugcantopaloglu/openclaw-dashboard

Affected ranges

Type

GIT

Repo

https://github.com/tugcantopaloglu/openclaw-dashboard

Events

Introduced

110c9a1e5bb50c72a9f61353cd3f34ccfbc044bc

Last Affected

110c9a1e5bb50c72a9f61353cd3f34ccfbc044bc

Database specific

Show details

{
    "cpe": "cpe:2.3:a:tugcantopaloglu:openclaw_agent_dashboard:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*

1.1.0

v1.*

v1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66421.json"