Open Computer Use CVE-2026-108722

Two chained prerequisites must both hold: (1) the attacker must control content that appears in the agent's observable output - e.g. a web page the agent visits or a file surfaced in run_command output - so that a script payload is captured into the transcript; and (2) a human operator must subsequently open the generated log.html in a browser, at which point the unescaped payload executes. Exploitation is limited to open-computer-use at or before commit 610bac8, is bounded to exfiltrating transcript contents viewable in the operator's browser (no server/system code execution), and cannot fire without the operator-interaction step, materially reducing realistic risk below the network-reachable surface the raw vector suggests.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) scores only 2.3, and the multiple dampening factors are real: AT:P reflects that the attacker must first get malicious content into the sandbox's observable output, and UI:P reflects that a human operator must subsequently open the generated log.html. Impact is limited to VC:L/VI:L with no availability impact and no scope/subsequent-system effect (SC:N/SI:N/SA:N), consistent with reflected transcript exfiltration in the operator's browser rather than system compromise. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code is referenced - only a third-party HackMD write-up and the vulnerable source lines on GitHub. Exploitation status: no public exploit identified at time of analysis. The combination of low technical impact, mandatory attacker-controlled-content + operator-interaction preconditions, and a niche affected product means this is a low-CVSS, low-real-risk hardening fix rather than an urgent patch. Note the CVSS vector claims PR:N (unauthenticated); this is accurate for the operator-side trigger but obscures that the attacker must still achieve control over sandbox content as a practical precondition captured by AT:P.

An attacker lures the open-computer-use agent to a web page or file they control so that attacker-chosen text appears in run_command output; that text contains an HTML/JavaScript payload. Because Logger.write_log_file writes transcript text into log.html without HTML escaping, the payload is stored in the log, and when an operator later opens log.html in a browser the script executes and exfiltrates transcript contents. No public exploit code is referenced, though a third-party HackMD write-up documents the flaw, and the CVSS vector's AT:P/UI:P reflect the required attacker-controlled content and operator interaction.