Executive brief
OpenClaw is a security and data analysis platform that allows operators to export session data as HTML files. The application fails to sanitize unsafe markdown links (javascript: and data: URIs) when generating these exports, potentially allowing an attacker to inject malicious scripts that execute when a trusted operator opens the file and clicks a link.
Technical details
OpenClaw versions up to 2026.5.7 contain an improper input neutralization vulnerability (CWE-79) in the session export feature. The vulnerability occurs because unsafe markdown links with javascript: or data: protocols are preserved in the generated HTML output without proper sanitization. An attacker must trick a trusted operator into opening the exported HTML file in a privileged browser context and clicking a malicious link to trigger script execution. The attack requires user interaction and network reachability to the affected feature. OpenClaw addressed this vulnerability in version 2026.5.12.
Affected products
- OpenClaw OpenClaw <= 2026.5.7
Timeline
- 2026-05-28: disclosed
- 2026-05-12: patched: Version 2026.5.12 patched