CVE-2026-53841
MEDIUMOpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML
Title source: cnaDescription
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-w9hf-3pp7-pvxv)
https://github.com/openclaw/openclaw/security/advisories/GHSA-w9hf-3pp7-pvxv
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML
https://www.vulncheck.com/advisories/openclaw-cross-site-scripting-via-unsafe-markdown-links-in-exported-session-html
Scores
CVSS v3
6.1
EPSS
0.0019
EPSS Percentile
8.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-83
Status
published
Products (5)
npm/openclaw
0 - 2026.5.12npm
openclaw/openclaw
2026.5.12 beta1 (8 CPE variants)
OpenClaw/OpenClaw
< 2026.5.12
openclaw/openclaw
< 2026.5.12
OpenClaw/OpenClaw
2026.5.12
Published
Jun 16, 2026
Tracked Since
Jun 17, 2026