Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108722— open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

Quick assessment

Affected
e2b-dev open-computer-use
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

open-computer-use（在 commit 610bac8 之前）中存在一个存储型跨站脚本（XSS）漏洞，该漏洞位于 os_computer_use/logging.py 文件中的 Logger.write_log_file 函数里。该函数将转录文本（transcript text）直接写入 log.html 文件，而未进行 HTML 转义。攻击者若能够控制沙箱中的内容（例如网页或 run_command 输出中显示的文件），便可注入恶意脚本；当操作员打开日志文件时，这些脚本将自动执行，从而窃取转录内容的

CVSS 4.2 · Medium EPSS 0.23% · P13

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProduct Version RangeStatus
e2b-dev open-computer-use ≤ 610bac85d242b2fdf43fbe36bce2348658a2d4c9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108722

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
Source: CVE Program / CVE List V5
Vulnerability Description
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
e2b-dev open-computer-use 0 ~ 610bac85d242b2fdf43fbe36bce2348658a2d4c9 -

II. Public POCs for CVE-2026-108722

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108722

请登录查看更多情报信息。

Proof of Concept for CVE-2026-108722 (1)

News Coverage for CVE-2026-108722 (2)

Other References for CVE-2026-108722 (2)

IV. Related Vulnerabilities

Same product: open-computer-use
Same weakness: CWE-79

V. Comments for CVE-2026-108722

No comments yet

Leave a comment