CVE-2026-53841: OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML
Summary
Exported session HTML could keep unsafe markdown links. In affected versions, content rendered into an exported session could preserve unsafe javascript: or data: links in generated HTML.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
Impact
When the affected feature is enabled and reachable, this could run browser-side script if a trusted operator opens the exported file and activates the link. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Patched Versions
The first stable patched version is 2026.5.12.
Mitigations
do not open exported session HTML from untrusted content in a privileged browser profile until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Other sources
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.5.12 - Compensating control
Do not open exported session HTML from untrusted content in a privileged browser profile until patched.
- Compensating control
Keep channel and tool allowlists narrow.
- Compensating control
Avoid sharing one Gateway between mutually untrusted users.
- Compensating control
Disable the exported session HTML feature when it is not needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53841?
The severity of CVE-2026-53841 is classified as low, with a score of 2.1.
How do I fix CVE-2026-53841?
To fix CVE-2026-53841, update OpenClaw to version 2026.5.12 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2026-53841?
CVE-2026-53841 is a Cross-Site Scripting (XSS) vulnerability resulting from unsafe markdown links in exported session HTML.
What are the affected software versions for CVE-2026-53841?
The affected versions for CVE-2026-53841 are all versions of OpenClaw prior to 2026.5.12.
What can attackers potentially do with CVE-2026-53841?
Attackers can exploit CVE-2026-53841 by using unsafe `javascript:` or `data:` links in exported session HTML to execute malicious scripts in the user's browser.