Stored XSS in open-computer-use Logger

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the open-computer-use tool. It occurs in the Logger.write_log_file function in os_computer_use/logging.py, where transcript text is written to log.html without proper HTML escaping. Attackers can inject malicious scripts into sandbox content, such as web pages or files, which execute when operators open the log file. This allows attackers to exfiltrate transcript contents.

Useful 0 Not Useful 0

Detection Guidance

Check log.html files generated by open-computer-use for suspicious script tags or unescaped HTML content. Inspect Logger.write_log_file in os_computer_use/logging.py for improper HTML escaping of transcript text.

Useful 0 Not Useful 0

Impact Analysis

If you use open-computer-use, attackers could gain access to sensitive data in your logs, such as transcript contents, by injecting malicious scripts. This could lead to data breaches or unauthorized access to your system's interactions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by exposing sensitive data in logs. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach could result in legal penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update to a patched version of open-computer-use where Logger.write_log_file properly escapes HTML in log.html. If unavailable, manually escape HTML in transcript text before writing to logs or disable logging of untrusted content.

Useful 0 Not Useful 0