PocketClawvol. 1 · 2026
vulnerabilitymedium · CVSS 6.1patched

CVE-2026-24112

IronClaw — XSS in audit log viewer

Summary

The IronClaw audit log viewer rendered tool call arguments without HTML escaping. A malicious tool call could inject script tags that executed in the context of an authenticated admin viewing the log.

Details

CVE IDCVE-2026-24112
Severitymedium (6.1)
CVSS vectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published2026-04-08
Patched2026-04-12
Affected versions1.0.0 – 1.1.4
Fixed in1.1.5
Exploited in the wildno known exploitation

Affected projects

IronClaw

What to do

  • If you run an affected version: upgrade to 1.1.5 immediately. Do not delay this for convenience reasons.
  • Rotate any credentials that may have been exposed via the affected component.
  • Audit your logs for indicators of exploitation — unexpected outbound traffic, anomalous tool calls, unfamiliar authenticated sessions.
  • If exploitation is confirmed, treat the host as compromised: rebuild from a clean image, rotate every secret on the host, audit lateral movement.

Sources

See also: all CVEs, tracked agents, methodology.