Open Computer Use
Monthly
Stored cross-site scripting in open-computer-use through commit 610bac8 lets an attacker who controls content the agent observes (such as a web page or run_command output) inject script into the generated log.html, which then executes when a human operator opens the log and can exfiltrate transcript contents. Exploitation requires both attacker-controlled sandbox content and operator interaction, so this is a low-priority issue (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) rather than a directly exploitable server-side compromise; no public exploit identified at time of analysis.
Local MCP callers and prompt-injected model turns can bypass the password-manager denylist in Open Computer Use through 1.0.0 on macOS by supplying case-variant bundle identifiers such as 'com.1Password.1Password', letting them invoke get_app_state and action tools against a running password manager. Successful abuse reads accessibility trees, captures screenshots, and drives the unlocked interface of applications that the denylist was explicitly designed to shield, resulting in high confidentiality impact with limited integrity impact to the host. The attack is local-only, requires the agent to already hold macOS accessibility and screen-recording permissions, and requires the target password manager to be unlocked; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch was identified at time of analysis.
Stored cross-site scripting in open-computer-use through commit 610bac8 lets an attacker who controls content the agent observes (such as a web page or run_command output) inject script into the generated log.html, which then executes when a human operator opens the log and can exfiltrate transcript contents. Exploitation requires both attacker-controlled sandbox content and operator interaction, so this is a low-priority issue (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) rather than a directly exploitable server-side compromise; no public exploit identified at time of analysis.
Local MCP callers and prompt-injected model turns can bypass the password-manager denylist in Open Computer Use through 1.0.0 on macOS by supplying case-variant bundle identifiers such as 'com.1Password.1Password', letting them invoke get_app_state and action tools against a running password manager. Successful abuse reads accessibility trees, captures screenshots, and drives the unlocked interface of applications that the denylist was explicitly designed to shield, resulting in high confidentiality impact with limited integrity impact to the host. The attack is local-only, requires the agent to already hold macOS accessibility and screen-recording permissions, and requires the target password manager to be unlocked; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch was identified at time of analysis.