CVE-2026-27485 json
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
published 2026-02-20 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-7714 , GHSA-r6h2-5gqq-v5v6
- cvss
- 4.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, skills/skill-creator/scripts/package_skill.py (a local helper script used when authors package skills) previously followed symlinks while building .skill archives. If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents. If exploited, this vulnerability can lead to potential unintentional disclosure of local files from the packaging machine into a generated .skill artifact, but requires local execution of the packaging script on attacker-controlled skill contents. This issue has been fixed in version 2026.2.18.
Patch / fix
- npm openclaw 2026.2.19
- openclaw openclaw 2026.2.19
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 4.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | openclaw | <2026.2.19 |
2026.2.19 |
Affected products
- openclaw openclaw
Classification
- Weakness
-
- CWE-61 UNIX Symbolic Link (Symlink) Following
References
-
github.com
/openclaw/openclaw/pull/20796
web, issue-tracking
-
github.com
/openclaw/openclaw/commit/c275932aa4230fb7a8212fe1b9d2a18424874b3f
web, patch
-
github.com
/openclaw/openclaw/commit/ee1d6427b544ccadd73e02b1630ea5c29ba9a9f0
web, patch
-
github.com
/openclaw/openclaw/security/advisories/GHSA-r6h2-5gqq-v5v6
web, mitigation, vendor-advisory
-
github.com
/openclaw/openclaw/releases/tag/v2026.2.19
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-27485
advisory
-
github.com
/openclaw/openclaw
package
Sources
- CVE List CVE-2026-27485
- GitHub Advisory GHSA-r6h2-5gqq-v5v6
- NVD CVE-2026-27485
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.