CVE-2026-53841: OpenClaw XSS via unsafe links

Q: Is CVE-2026-53841 actively exploited?

No confirmed active exploitation of CVE-2026-53841 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-53841?

1. Patch: Upgrade OpenClaw to version 2026.5.12 or later — this release removes the unsafe link passthrough in session HTML exports. 2. Interim workaround: Prohibit opening exported session HTML directly in any browser; pipe exports through a PDF renderer or text editor instead. 3. Immediate detection: Scan all previously exported OpenClaw HTML files for `href="javascript:` and `href="data:` string patterns — any match warrants review of the originating session. 4. Defense-in-depth: Enforce a strict Content-Security-Policy header on any internal tooling that serves OpenClaw exports; a `script-src 'none'` policy blocks inline script execution even if the file is opened via a web server. 5. Process control: Add a sanitization step (e.g., DOMPurify in an offline script) to existing exported archives before distributing to reviewers.

Q: What systems are affected by CVE-2026-53841?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI workflow tools, customer-facing AI agents.

Q: What is the CVSS score for CVE-2026-53841?

CVE-2026-53841 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.19%.

CISO Take

OpenClaw before 2026.5.12 fails to sanitize `javascript:` and `data:` URI schemes when rendering session exports to HTML, meaning any malicious link embedded in agent conversation content survives into the exported file intact. The Changed scope (CVSS S:C) means a successful click can reach browser context outside the document itself — session tokens, locally accessible cookies, or credentials stored in the operator's browser profile are all in play. With zero privileges required on the attacker side and a typical operator workflow that routinely exports sessions for compliance review or incident investigation, the practical attack surface is larger than the Medium CVSS implies for teams running customer-facing OpenClaw agents. Upgrade to 2026.5.12 immediately; as an interim control, open exported HTML only in a sandboxed viewer or convert to PDF before review.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium risk (CVSS 6.1) with elevated practical concern for AI agent deployments. The zero-privilege, network-accessible attack vector means any external user who can inject content into an OpenClaw session is a potential threat actor — no account or authentication is needed. The required user interaction (clicking the link) prevents autonomous exploitation but is easily triggered through social engineering in a realistic operator workflow. No public exploit exists and the vulnerability is not in CISA KEV, keeping near-term exploitation probability low. The Changed scope is the key escalating factor: if the link is activated, impact extends beyond the vulnerable HTML document to the operator's full browser context.

How does the attack unfold?

Content Injection

Adversary submits a session message to the OpenClaw agent containing a malicious `javascript:` or `data:` URI disguised as a legitimate reference link.

AML.T0051.001

Persistence in Export

The OpenClaw session export function renders conversation history to HTML without sanitizing unsafe URI schemes, preserving the malicious link verbatim in the output file.

AML.T0080.001

User Execution

A trusted operator opens the exported HTML file in a browser during a compliance review or incident investigation and clicks the malicious link.

AML.T0011.003

Browser-Side Impact

The browser executes the attacker-controlled script in the operator's context, potentially exfiltrating session tokens, cookies, or locally accessible credentials to an external endpoint.

AML.T0025

Content Injection

Adversary submits a session message to the OpenClaw agent containing a malicious `javascript:` or `data:` URI disguised as a legitimate reference link.

AML.T0051.001

Persistence in Export

The OpenClaw session export function renders conversation history to HTML without sanitizing unsafe URI schemes, preserving the malicious link verbatim in the output file.

AML.T0080.001

User Execution

A trusted operator opens the exported HTML file in a browser during a compliance review or incident investigation and clicks the malicious link.

AML.T0011.003

Browser-Side Impact

The browser executes the attacker-controlled script in the operator's context, potentially exfiltrating session tokens, cookies, or locally accessible credentials to an external endpoint.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	npm	<= 2026.5.7	`2026.5.12`
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.5.12 or later — this release removes the unsafe link passthrough in session HTML exports.
Interim workaround: Prohibit opening exported session HTML directly in any browser; pipe exports through a PDF renderer or text editor instead.
Immediate detection: Scan all previously exported OpenClaw HTML files for href="javascript: and href="data: string patterns — any match warrants review of the originating session.
Defense-in-depth: Enforce a strict Content-Security-Policy header on any internal tooling that serves OpenClaw exports; a script-src 'none' policy blocks inline script execution even if the file is opened via a web server.
Process control: Add a sanitization step (e.g., DOMPurify in an offline script) to existing exported archives before distributing to reviewers.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Social Engineering Data Leakage Agent AML.T0011 - User Execution AML.T0011.003 - Malicious Link AML.T0051.001 - Indirect AML.T0080.001 - Thread

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9(2)(a) - Risk management system — identification and analysis of risks

ISO 42001

8.4 - AI system operation

NIST AI RMF

MS-2.5 - AI system output integrity

OWASP LLM Top 10

LLM02 - Insecure Output Handling

Frequently Asked Questions

What is CVE-2026-53841?

OpenClaw before 2026.5.12 fails to sanitize `javascript:` and `data:` URI schemes when rendering session exports to HTML, meaning any malicious link embedded in agent conversation content survives into the exported file intact. The Changed scope (CVSS S:C) means a successful click can reach browser context outside the document itself — session tokens, locally accessible cookies, or credentials stored in the operator's browser profile are all in play. With zero privileges required on the attacker side and a typical operator workflow that routinely exports sessions for compliance review or incident investigation, the practical attack surface is larger than the Medium CVSS implies for teams running customer-facing OpenClaw agents. Upgrade to 2026.5.12 immediately; as an interim control, open exported HTML only in a sandboxed viewer or convert to PDF before review.

Is CVE-2026-53841 actively exploited?

No confirmed active exploitation of CVE-2026-53841 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-53841?

1. Patch: Upgrade OpenClaw to version 2026.5.12 or later — this release removes the unsafe link passthrough in session HTML exports. 2. Interim workaround: Prohibit opening exported session HTML directly in any browser; pipe exports through a PDF renderer or text editor instead. 3. Immediate detection: Scan all previously exported OpenClaw HTML files for `href="javascript:` and `href="data:` string patterns — any match warrants review of the originating session. 4. Defense-in-depth: Enforce a strict Content-Security-Policy header on any internal tooling that serves OpenClaw exports; a `script-src 'none'` policy blocks inline script execution even if the file is opened via a web server. 5. Process control: Add a sanitization step (e.g., DOMPurify in an offline script) to existing exported archives before distributing to reviewers.

What systems are affected by CVE-2026-53841?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI workflow tools, customer-facing AI agents.

What is the CVSS score for CVE-2026-53841?

CVE-2026-53841 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI workflow toolscustomer-facing AI agents

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0011.003 Malicious Link

AML.T0051.001 Indirect

AML.T0080.001 Thread

Compliance Controls Affected

EU AI Act: Article 9(2)(a)

ISO 42001: 8.4

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link.

Exploitation Scenario

A threat actor targeting a SOC or compliance team running OpenClaw submits a support ticket through a customer-facing AI agent interface. The ticket body contains a markdown-formatted link using a `data:text/html,<script>...</script>` payload — carefully worded to look like a legitimate reference URL. The OpenClaw agent processes the ticket, stores the conversation in its session database, and the malicious link is preserved verbatim. Three days later, a compliance analyst exports the session batch to HTML for monthly audit evidence, opens the file in Chrome, and clicks the link while reviewing the conversation. The `data:` URI loads an attacker-controlled mini-HTML page in the same browser process, which reads `document.cookie` and `localStorage` values accessible to the local origin and exfiltrates them to an external endpoint — including any session tokens the analyst stored from authenticated internal tools accessed earlier in the same browser session.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-83 Improper Neutralization of Script in Attributes in a Web Page Primary CWE-83 Improper Neutralization of Script in Attributes in a Web Page

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.