Low severityNVD Advisory· Published Mar 19, 2026· Updated Mar 21, 2026
OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation
CVE-2026-32040
Description
OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers can craft session entries with specially crafted mimeType attributes that break out of the img src data-URL context to achieve cross-site scripting when exported HTML is opened.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.23 | 2026.2.23 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-2ww6-868g-2c56ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-2ww6-868g-2c56ghsathird-party-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-32040ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-html-injection-via-unvalidated-image-mime-type-in-data-url-interpolationghsathird-party-advisoryWEB
- github.com/openclaw/openclaw/commit/f3adf142c195000cbde31200626a1d8c8b716df9ghsaWEB
- github.com/openclaw/openclaw/pull/24140ghsaproductWEB
News mentions
0No linked articles in our index yet.