Summary
OpenClaw Dashboard contains a stored cross-site scripting (XSS) flaw where attacker-controlled transcript messages are rendered directly into the administrator UI.
By injecting crafted HTML with inline event handlers into agent transcripts, an unauthenticated attacker can execute arbitrary JavaScript in an admin's browser, potentially leading to token theft and unauthorized administrative actions.
OpenClaw Dashboard contains a stored cross-site scripting (XSS) flaw where attacker-controlled transcript messages are rendered directly into the administrator UI.
By injecting crafted HTML with inline event handlers into agent transcripts, an unauthenticated attacker can execute arbitrary JavaScript in an admin's browser, potentially leading to token theft and unauthorized administrative actions.
Affected context
The vulnerability manifests in the OpenClaw Dashboard session transcript rendering flow.
Agent transcript messages, obtained from the sessions API, are stored and later interpolated directly into innerHTML on the default landing page without robust sanitization or escaping.
When an administrator views affected sessions in a standard browser environment with active authentication, malicious markup embedded in prior messages can execute in the admin's context.
The vulnerability manifests in the OpenClaw Dashboard session transcript rendering flow.
Agent transcript messages, obtained from the sessions API, are stored and later interpolated directly into innerHTML on the default landing page without robust sanitization or escaping.
When an administrator views affected sessions in a standard browser environment with active authentication, malicious markup embedded in prior messages can execute in the admin's context.
Exploit preconditions
- Attack surface: Publicly exposed sessions API that accepts agent transcript messages.
- Required access: Network reachability to submit or influence transcript messages; no authentication is required according to the description.
- Trigger point: An authenticated administrator navigates to the default landing page or any UI view that renders the stored transcript containing the injected payload.
- Why exploitation is possible: User-supplied HTML content is persisted and then inserted into the DOM using
innerHTMLwithout proper encoding or sanitization, enabling embedded event handlers (for example,onerror) to run arbitrary JavaScript.
- Attack surface: Publicly exposed sessions API that accepts agent transcript messages.
- Required access: Network reachability to submit or influence transcript messages; no authentication is required according to the description.
- Trigger point: An authenticated administrator navigates to the default landing page or any UI view that renders the stored transcript containing the injected payload.
- Why exploitation is possible: User-supplied HTML content is persisted and then inserted into the DOM using
innerHTMLwithout proper encoding or sanitization, enabling embedded event handlers (for example,onerror) to run arbitrary JavaScript.
Why this happens
This issue arises from untrusted input being treated as safe HTML and directly passed to the browser for rendering.
Instead of encoding user-supplied content as text or passing it through an HTML and script sanitizer, the application interpolates the transcript message into innerHTML, allowing execution of event handler attributes and other script-capable constructs.
Conceptually, this is a classic CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), where data from an external source is injected into a web page without appropriate context-aware escaping or filtering.
This issue arises from untrusted input being treated as safe HTML and directly passed to the browser for rendering.
Instead of encoding user-supplied content as text or passing it through an HTML and script sanitizer, the application interpolates the transcript message into innerHTML, allowing execution of event handler attributes and other script-capable constructs.
Conceptually, this is a classic CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), where data from an external source is injected into a web page without appropriate context-aware escaping or filtering.
Potential impact
- Theft or exfiltration of administrator session tokens and other sensitive browser-stored credentials.
- Unauthorized invocation of administrative API endpoints via the admin's session, including modifying agent instruction files or configuration.
- Escalation of attacker capabilities from unauthenticated user to effective administrative control of the dashboard.
- Persistent compromise of the administration interface, including the ability to inject further malicious content into other users' views.
- Theft or exfiltration of administrator session tokens and other sensitive browser-stored credentials.
- Unauthorized invocation of administrative API endpoints via the admin's session, including modifying agent instruction files or configuration.
- Escalation of attacker capabilities from unauthenticated user to effective administrative control of the dashboard.
- Persistent compromise of the administration interface, including the ability to inject further malicious content into other users' views.
General mitigation guidance
Effective mitigation typically focuses on strict separation between data and executable content.
Common defensive patterns include:
- Treating all transcript and chat content as untrusted and rendering it as text, with context-appropriate escaping for HTML, attributes, and URLs.
- Avoiding direct use of
innerHTMLand other HTML injection sinks for rendering user-controlled strings; instead, use safe DOM APIs that set text content by default. - Applying well-maintained, allowlist-based HTML sanitization when limited markup must be supported, explicitly stripping event handlers, scripts, and dangerous attributes.
- Enforcing a security architecture where privileged actions require explicit server-side authorization independent of browser-executed JavaScript.
- Considering Content Security Policy (CSP) that restricts inline scripts and event handlers to reduce the impact of any residual injection issues.
Effective mitigation typically focuses on strict separation between data and executable content.
Common defensive patterns include:
- Treating all transcript and chat content as untrusted and rendering it as text, with context-appropriate escaping for HTML, attributes, and URLs.
- Avoiding direct use of
innerHTMLand other HTML injection sinks for rendering user-controlled strings; instead, use safe DOM APIs that set text content by default. - Applying well-maintained, allowlist-based HTML sanitization when limited markup must be supported, explicitly stripping event handlers, scripts, and dangerous attributes.
- Enforcing a security architecture where privileged actions require explicit server-side authorization independent of browser-executed JavaScript.
- Considering Content Security Policy (CSP) that restricts inline scripts and event handlers to reduce the impact of any residual injection issues.
How teams detect issues like this
Detection efforts can focus on both code and behavior:
- Static analysis rules that flag assignments of untrusted data to
innerHTML,outerHTML, or similar sinks without prior encoding or sanitization. - Code review checklists that require tracing all data flows from external APIs (such as the sessions API) into the rendered UI, verifying that encoding is context-aware and centralized.
- Automated scanning with dynamic application security testing (DAST) tools that submit XSS probes through transcript or chat channels and monitor rendered pages for script execution.
- Logging and monitoring for anomalous administrative actions or sudden spikes in session-related requests that may indicate successful XSS exploitation via the admin's browser.
Detection efforts can focus on both code and behavior:
- Static analysis rules that flag assignments of untrusted data to
innerHTML,outerHTML, or similar sinks without prior encoding or sanitization. - Code review checklists that require tracing all data flows from external APIs (such as the sessions API) into the rendered UI, verifying that encoding is context-aware and centralized.
- Automated scanning with dynamic application security testing (DAST) tools that submit XSS probes through transcript or chat channels and monitor rendered pages for script execution.
- Logging and monitoring for anomalous administrative actions or sudden spikes in session-related requests that may indicate successful XSS exploitation via the admin's browser.
