RoboSats v0.8.7-alpha fixes client-side XSS; patch for a second issue involving reward payouts is unconfirmed

RoboSats v0.8.7-alpha fixes XSS in the coordinator information window: the coordinator's message is now displayed as text rather than HTML, closing this path for web, Android and desktop clients. However, a fix for the second issue in the advisory is unconfirmed: when a reward payout times out, the amount may be returned to the robot even though the first Lightning payment may still complete, allowing the reward to be received twice. This affects coordinator operators. Both issues are rated medium in the advisory; no exploitation has been reported.

Actions to take

RoboSats users: update to v0.8.7-alpha from the official release to fix XSS through the coordinator information window. Coordinator operators: until a fix is separately confirmed, do not consider the duplicate reward payout issue resolved; pause reward withdrawals or increase the timeout and manually reconcile payments that may still be in flight before paying again.

Sources:

Incident history

12 SeptRoboSats v0.8.7-alpha fixes client-side XSS; patch for a second issue involving reward payouts is unconfirmed
31 OctRoboSats v0.8.8-alpha: XSS in order logs fixed, coordinator payout checks added, old Android client no longer connects