CVE-2026-53841

Published: Jun 16, 2026Modified: Jun 17, 2026

2.1

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.

Affected (9)

Products: Openclaw: Openclaw

Openclaw

1 product

Openclaw

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openclaw Openclaw	Before 2026.5.12
Openclaw Openclaw	Version 2026.5.12 beta1
Openclaw Openclaw	Version 2026.5.12 beta2
Openclaw Openclaw	Version 2026.5.12 beta3
Openclaw Openclaw	Version 2026.5.12 beta4
Openclaw Openclaw	Version 2026.5.12 beta5
Openclaw Openclaw	Version 2026.5.12 beta6
Openclaw Openclaw	Version 2026.5.12 beta7
Openclaw Openclaw	Version 2026.5.12 beta8

Related CWEs

CWE-83

Improper Neutralization of Script in Attributes in a Web Page

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

References (2)

https://github.com/openclaw/openclaw/security/advisories/GHSA-w9hf-3pp7-pvxv

Source: disclosure@vulncheck.com

Vendor Advisory

https://www.vulncheck.com/advisories/openclaw-cross-site-scripting-via-unsafe-markdown-links-in-exported-session-html

Source: disclosure@vulncheck.com

Third Party Advisory

Timeline

No history available yet.