https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:17:10 +0000 https://cve.radiocsirt.org/vuln/cve-2026-27009 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `&lt;script&gt;` tag without script-context-safe escaping. A crafted value containing `&lt;/script&gt;` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src &#39;self&#39;`, no inline scripts).</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a atored XSS issue in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `&lt;script&gt;` tag without script-context-safe escaping. A crafted value containing `&lt;/script&gt;` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin. Version 2026.2.15 removed inline script injection and serve bootstrap config from a JSON endpoint and added a restrictive Content Security Policy for the Control UI (`script-src &#39;self&#39;`, no inline scripts).</p> https://cve.radiocsirt.org/vuln/cve-2026-27009