{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T15:28:12.895","vulnerabilities":[{"cve":{"id":"CVE-2026-27009","sourceIdentifier":"security-advisories@github.com","published":"2026-02-20T00:16:17.620","lastModified":"2026-06-17T10:26:31.890","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src 'self'`, no inline scripts)."},{"lang":"es","value":"OpenClaw es un asistente personal de IA. Antes de la versión 2026.2.15, existía un problema de XSS almacenado en la interfaz de usuario de control de OpenClaw al renderizar la identidad del asistente (nombre/avatar) en una etiqueta `` podría escapar de la etiqueta de script y ejecutar JavaScript controlado por el atacante en el origen de la interfaz de usuario de control. La versión 2026.2.15 eliminó la inyección de scripts en línea y sirve la configuración de arranque desde un endpoint JSON, y añadió una Política de Seguridad de Contenido restrictiva para la interfaz de usuario de control (`script-src 'self'`, sin scripts en línea)."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openclaw","product":"openclaw","versions":[{"version":"< 2026.2.15","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-20T15:29:24.166626Z","id":"CVE-2026-27009","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2026.2.15","matchCriteriaId":"3CD9AC99-DDDF-4177-9253-04A63CA027DC"}]}]}],"references":[{"url":"https://github.com/openclaw/openclaw/commit/3b4096e02e7e335f99f5986ec1bd566e90b14a7e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openclaw/openclaw/commit/adc818db4a4b3b8d663e7674ef20436947514e1b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.15","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]}]}}]}