PT-2026-49758 · Openclaw · Openclaw

Edward-X · CVE-2026-53841 · Published 2026-06-16 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12

Description Exported session HTML preserves unsafe javascript: and data: links in generated content. This allows for the execution of browser-side scripts if a trusted operator opens the exported file and activates a malicious link. The impact depends on the operator's configuration and whether lower-trust input can reach the affected path.

Recommendations Update to version 2026.5.12. Do not open exported session HTML from untrusted content in a privileged browser profile. Keep channel and tool allowlists narrow. Avoid sharing one Gateway between mutually untrusted users. Disable the session export feature when it is not needed.

Exploit

Fix

XSS

Weakness Enumeration

CWE-83

CWE-79

Related Identifiers

CVE-2026-53841

GHSA-6XCG-6Q43-RJ2V

GHSA-W9HF-3PP7-PVXV

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53841.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-w9hf-3pp7-pvxv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w9hf-3pp7-pvxv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53841 · Security Note
• https://osv.dev/vulnerability/GHSA-6xcg-6q43-rj2v · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/cveNotify/168746 · Telegram Post
• https://vulncheck.com/advisories/openclaw-cross-site-scripting-via-unsafe-markdown-links-in-exported-session-html · Note
• https://t.me/cveNotify/168871 · Telegram Post