Medium severity4.6NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026
CVE-2026-32040
CVE-2026-32040
Description
OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers can craft session entries with specially crafted mimeType attributes that break out of the img src data-URL context to achieve cross-site scripting when exported HTML is opened.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.23 | 2026.2.23 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/openclaw/openclaw/security/advisories/GHSA-2ww6-868g-2c56nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-2ww6-868g-2c56ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32040ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-html-injection-via-unvalidated-image-mime-type-in-data-url-interpolationnvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/commit/f3adf142c195000cbde31200626a1d8c8b716df9ghsaWEB
- github.com/openclaw/openclaw/pull/24140nvdIssue TrackingWEB
News mentions
0No linked articles in our index yet.