CyberRota Analysis
AI-GeneratedOpenClaw Dashboard v3.0.0 is vulnerable to a stored cross-site scripting (XSS) attack, allowing unauthenticated remote attackers to inject malicious scripts through a crafted username in failed login attempts. This vulnerability can lead to the execution of arbitrary code in the context of an administrator's session, potentially enabling unauthorized changes to configurations and agent instruction files. Organizations using this version of OpenClaw Dashboard should prioritize immediate remediation to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers, enabling the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes.