Stored XSS in OpenClaw Control UI via unsanitized assistant identity
OpenClaw's Control UI contained a stored cross-site scripting vulnerability in versions up to 2026.2.14 where unsanitized assistant name and avatar values injected into inline script blocks could enable attackers to execute malicious code. The vulnerability was fixed in version 2026.2.15 by removing inline script injection and adding Content Security Policy restrictions.
What happened
The OpenClaw Control UI injected assistantName and assistantAvatar values directly into an inline <script> block using JSON.stringify(), which does not prevent </script> from terminating the script element.
A crafted assistant identity value containing </script> could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin.
Reported impact
An attacker with the ability to set assistant identity values could cause JavaScript execution for Control UI visitors, enabling token/session theft and privileged actions in the UI.
Index analysis
OpenClaw's Control UI is intended for local use only, and the advisory's CVSS reflects a loopback-only/local-access deployment assumption.
Governance controls
The fix removed inline script injection and served bootstrap config from a JSON endpoint, and added a restrictive Content Security Policy for the Control UI restricting script sources to 'self' with no inline scripts.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.