MEDIUM

CVE-2026-53841

Openclaw Openclaw 2026-06-16 CVSS v3.1

CVSS

6.1

Description

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.

Summary dbcve.org

OpenClaw before version 2026.5.12 has a stored XSS vulnerability in its session HTML export feature. The exported HTML files preserve unsafe javascript: and data: URI schemes in links, allowing attackers to embed malicious links that execute arbitrary JavaScript when a trusted user opens the exported file and clicks the malicious link.

Mitigation

Upgrade to OpenClaw version 2026.5.12 or later, which implements proper sanitization of links in exported HTML to remove unsafe URI schemes. Until upgraded, users should avoid clicking untrusted links in exported session files.

Weakness (CWE)

CWE-83

EPSS Score

0.19%

Probability of exploitation in next 30 days

8.7th percentile

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-w9hf-3pp7-pvxv Vendor Advisory https://www.vulncheck.com/advisories/openclaw-cross-site-scripting-via-unsafe-markdown-links-in-exported-session-html Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE