Executive brief
OpenClaw is a session analysis and collaboration tool that allows users to export sessions as HTML files for sharing and review. A stored XSS vulnerability in the HTML export feature allows attackers to inject malicious JavaScript into exported files by crafting sessions with raw HTML or unescaped metadata. When a victim opens the exported HTML file, the attacker's code executes in their browser, potentially exposing sensitive session data or enabling phishing and UI spoofing attacks.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the session HTML exporter. The root cause is insufficient input sanitization when rendering markdown and inserting HTML: the exporter uses marked.parse() with innerHTML insertion but does not override the html renderer token handler, allowing raw HTML tokens (e.g., <img onerror=...>) to pass through unescaped. Additionally, tree/header metadata fields are interpolated into the export template without escaping. An attacker creates a session containing malicious HTML or script payloads, exports it, and when a victim opens the exported HTML file, the injected JavaScript executes with the privileges of the export viewer context. The fix, released in version 2026.2.23, adds a marked html(token) renderer override that escapes raw HTML, escapes metadata fields in the export template, and sanitizes image MIME types in data-URL rendering. No CVE is assigned; this is tracked as GHSA-r294-2894-92j3.
Affected products
- OpenClaw openclaw <= 2026.2.22-2
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched: Fix released in version 2026.2.23