Summary
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.2.22-2 - Patched version (released):
>= 2026.2.23
Technical Details
The exporter rendered markdown with marked.parse(...) and inserted HTML via innerHTML, but did not override the html renderer token path. Raw HTML (for example <img ... onerror=...>) was passed through. Additional tree/header metadata fields were interpolated without escaping in the export template.
Reproduction
- Create a session containing content like
<img src=x onerror=alert(1)>. - Export the session to HTML.
- Open the exported file.
- Observe script execution from injected content.
Fix Commit(s)
f8524ec77a3999d573e6c6b8a5055bf35c49a2e6
Release Process Note
patched_versions is pre-set to the released version (>= 2026.2.23). This advisory now reflects released fix version 2026.2.23.
OpenClaw thanks @allsmog for reporting.
Impact
Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Added a
markedhtml(token)renderer override that escapes raw HTML tokens. - Escaped previously unescaped tree/header metadata fields in the export template.
- Added image MIME sanitization for exported data-URL image rendering.
- Added regression tests for markdown/token and metadata escaping paths.
Frequently Asked Questions
- What is GHSA-R294-2894-92J3? GHSA-R294-2894-92J3 is a medium-severity cross-site scripting (XSS) vulnerability in openclaw (npm), affecting versions < 2026.2.23. It is fixed in 2026.2.23. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- Which versions of openclaw are affected by GHSA-R294-2894-92J3? openclaw (npm) versions < 2026.2.23 is affected.
- Is there a fix for GHSA-R294-2894-92J3? Yes. GHSA-R294-2894-92J3 is fixed in 2026.2.23. Upgrade to this version or later.
- Is GHSA-R294-2894-92J3 exploitable, and should I be worried? Whether GHSA-R294-2894-92J3 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-R294-2894-92J3 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-R294-2894-92J3? Upgrade
openclawto 2026.2.23 or later.