CVE-2026-32040
Received Received - Intake

HTML Injection in OpenClaw Session Exporter Enables XSS Execution

Publication date: 2026-03-19

Last updated on: 2026-03-23

Assigner: VulnCheck

Description
OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers can craft session entries with specially crafted mimeType attributes that break out of the img src data-URL context to achieve cross-site scripting when exported HTML is opened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-19
Last Modified
2026-03-23
Generated
2026-07-06
AI Q&A
2026-03-20
EPSS Evaluated
2026-07-05
NVD
CVE-2026-32040

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.2.23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw versions prior to 2026.2.23 have an HTML injection vulnerability in the HTML session exporter. This vulnerability allows attackers to execute arbitrary JavaScript by injecting malicious mimeType values into image content blocks.

Attackers can create session entries with specially crafted mimeType attributes that break out of the img src data-URL context, enabling cross-site scripting (XSS) when the exported HTML is opened.

Impact Analysis

This vulnerability can lead to cross-site scripting attacks, allowing attackers to execute arbitrary JavaScript in the context of the exported HTML session.

Such attacks can potentially lead to unauthorized actions, data theft, or session hijacking when a user opens the exported HTML containing the malicious code.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart