CVE-2026-32040
Received Received - Intake
HTML Injection in OpenClaw Session Exporter Enables XSS Execution

Publication date: 2026-03-19

Last updated on: 2026-03-23

Assigner: VulnCheck

Description
OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers can craft session entries with specially crafted mimeType attributes that break out of the img src data-URL context to achieve cross-site scripting when exported HTML is opened.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-19
Last Modified
2026-03-23
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-32040
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.2.23 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

OpenClaw versions prior to 2026.2.23 have an HTML injection vulnerability in the HTML session exporter. This vulnerability allows attackers to execute arbitrary JavaScript by injecting malicious mimeType values into image content blocks.

Attackers can create session entries with specially crafted mimeType attributes that break out of the img src data-URL context, enabling cross-site scripting (XSS) when the exported HTML is opened.

Impact Analysis

This vulnerability can lead to cross-site scripting attacks, allowing attackers to execute arbitrary JavaScript in the context of the exported HTML session.

Such attacks can potentially lead to unauthorized actions, data theft, or session hijacking when a user opens the exported HTML containing the malicious code.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart