{"id":"CVE-2026-108722","summary":"open-computer-use through commit 610bac8 Stored XSS via log.html Session Log","details":"open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.","modified":"2026-10-14T10:46:43.274019572Z","published":"2026-10-11T12:19:32.616Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108722.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108722.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind03/e2b-open-computer-use-html-log-injection"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108722"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/open-computer-use-through-commit-610bac8-stored-xss-via-log-html-session-log"},{"type":"PACKAGE","url":"https://github.com/e2b-dev/open-computer-use"},{"type":"ARTICLE","url":"https://github.com/e2b-dev/open-computer-use/blob/610bac85d242b2fdf43fbe36bce2348658a2d4c9/os_computer_use/logging.py#L60-L82"},{"type":"ARTICLE","url":"https://github.com/e2b-dev/open-computer-use/blob/610bac85d242b2fdf43fbe36bce2348658a2d4c9/os_computer_use/sandbox_agent.py#L25-L35"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind03/cve-2026-108722-e2b-open-computer-use-html-log-injection"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/e2b-dev/open-computer-use","events":[{"introduced":"0"},{"last_affected":"610bac85d242b2fdf43fbe36bce2348658a2d4c9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108722.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}