GHSA-r294-2894-92j3 OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering

Not scored Published 3 Mar 2026

OpenClaw library allows stored XSS via unescaped HTML in exported session files, enabling script execution and data exposure when users open crafted exports.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-r294-2894-92j3?

GHSA-r294-2894-92j3 is a cross-site scripting vulnerability in openclaw, published on 3 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Summary

The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields.

Impact

Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.22-2
Patched version (released): >= 2026.2.23

Technical Details

The exporter rendered markdown with marked.parse(...) and inserted HTML via innerHTML, but did not override the html renderer token path. Raw HTML (for example <img ... onerror=...>) was passed through. Additional tree/header metadata fields were interpolated without escaping in the export template.

Reproduction

Create a session containing content like <img src=x onerror=alert(1)>.
Export the session to HTML.
Open the exported file.
Observe script execution from injected content.

Remediation

Added a marked html(token) renderer override that escapes raw HTML tokens.
Escaped previously unescaped tree/header metadata fields in the export template.
Added image MIME sanitization for exported data-URL image rendering.
Added regression tests for markdown/token and metadata escaping paths.

Fix Commit(s)

f8524ec77a3999d573e6c6b8a5055bf35c49a2e6

Release Process Note

patched_versions is pre-set to the released version (>= 2026.2.23). This advisory now reflects released fix version 2026.2.23.

OpenClaw thanks @allsmog for reporting.

Which versions are affected by GHSA-r294-2894-92j3?

2 open source packages ship an affected version, including openclaw.

Package	Affected	Fixed in
`openclaw` npm	All versions	`2026.2.23`
`openclaw` npm	All versions	`2026.2.23`

How do I fix GHSA-r294-2894-92j3?

Upgrade openclaw to 2026.2.23 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-r294-2894-92j3 being exploited?

There is no known exploitation of GHSA-r294-2894-92j3 in the wild and no public exploit code.