e2b-dev open-computer-use Logger logging.py Logger.write_log_file cross site scripting

Summaryinfo

A vulnerability has been found in e2b-dev open-computer-use and classified as problematic. Affected by this issue is the function Logger.write_log_file of the file os_computer_use/logging.py of the component Logger. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-108722. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in e2b-dev open-computer-use (the affected version unknown) and classified as problematic. This issue affects the function Logger.write_log_file of the file os_computer_use/logging.py of the component Logger. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.

It is possible to read the advisory at hackmd.io. The identification of this vulnerability is CVE-2026-108722 since 10/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Applying the patch 610bac85d242b2fdf43fbe36bce2348658a2d4c9 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• e2b-dev

Name

• open-computer-use

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion