CVE-2026-66421

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard (affected versions not specified)

Description A stored cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in an administrator's browser session. This occurs when HTML markup is injected into agent transcript messages processed through the sessions API. Attackers can use inline event handler payloads, such as an img tag with an onerror attribute, within a 60-character limit. The payload is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page. This can lead to the theft of session tokens and unauthorized calls to authenticated administrative endpoints, including the modification of agent instruction files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.