Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

open-computer-use log.html can run malicious scripts

CVE-2026-108722 · published 7 days ago
Summary

The open-computer-use tool saves command transcripts to a file called log.html without cleaning the data. If an attacker can influence what appears in the transcript, they can insert hidden code that runs when someone opens the log, potentially stealing the session details. Update the software to a version that properly escapes content or apply a patch that filters out scripts.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
e2b-dev open-computer-use <= 610bac85d242b2fdf43fbe36bce2348658a2d4c9
Original advisory text
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Oct 2026
Updated16 Oct 2026
First seen11 Oct 2026
Sources
CVE-2026-108722 · NVD
CVE-2026-108722 · MITRE
CVE-2026-108722 · OSV
Track software like this
Free during beta