open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

Advisories

open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

severity: low
date: 10/11/2026
Affecting: open-computer-use <= 610bac85d242b2fdf43fbe36bce2348658a2d4c9
CVE: CVE-2026-108722
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 2.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind03/e2b-open-computer-use-html-log-injection
https://github.com/e2b-dev/open-computer-use/blob/610bac85d242b2fdf43fbe36bce2348658a2d4c9/os_computer_use/logging.py#L60-L82
https://github.com/e2b-dev/open-computer-use/blob/610bac85d242b2fdf43fbe36bce2348658a2d4c9/os_computer_use/sandbox_agent.py#L25-L35
https://github.com/e2b-dev/open-computer-use
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo