CVE-2026-108722 Details

A stored cross-site scripting vulnerability has been identified in the E2B Open-Computer-Use project, specifically in the logging functionality of the application. This vulnerability exists in the 'Logger.write_log_file' method within 'os_computer_use/logging.py', where transcript text is written to 'log.html' without proper HTML escaping. As a result, attackers can inject scripts that are executed when the log file is opened, potentially exfiltrating sensitive transcript information.

The vulnerability can be remediated by updating the 'write_log_file' method to escape the 'entry['text']' and color fields using 'html.escape' before interpolation. Additionally, the 'log.html' template should be modified to include a restrictive Content-Security-Policy meta tag, and a regression test should be added to ensure that injected payloads are properly escaped in the log file.