CVE-2026-32040: OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation
OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers can craft session entries with specially crafted mimeType attributes that break out of the img src data-URL context to achieve cross-site scripting when exported HTML is opened.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.2.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32040?
CVE-2026-32040 is considered a high-severity vulnerability due to the potential for arbitrary JavaScript execution.
How do I fix CVE-2026-32040?
To fix CVE-2026-32040, upgrade OpenClaw to version 2026.2.23 or later.
What type of vulnerability is CVE-2026-32040?
CVE-2026-32040 is an HTML injection vulnerability caused by unvalidated image MIME types.
Who is affected by CVE-2026-32040?
Users of OpenClaw versions prior to 2026.2.23 are affected by CVE-2026-32040.
What can attackers do with CVE-2026-32040?
Attackers can exploit CVE-2026-32040 to inject malicious JavaScript into web pages.