---
id: CVE-2026-32040
title: >-
  OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in
  Data-URL Interpolation
summary: >-
  OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability
  in the HTML session exporter that allows attackers to execute arbitrary
  javascript by injecting malicious mimeType values in image content blocks.
  Attackers can…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: OpenClaw
product: OpenClaw
affected:
  - OpenClaw < 2026.2.23
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-21T03:12:48.792622Z'
published: '2026-03-19'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:56.880Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-32040'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-2ww6-868g-2c56
    label: GitHub Security Advisory (GHSA-2ww6-868g-2c56)
  - url: 'https://github.com/openclaw/openclaw/pull/24140'
    label: Patch PR
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-html-injection-via-unvalidated-image-mime-type-in-data-url-interpolation
    label: >-
      VulnCheck Advisory: OpenClaw < 2026.2.23 - HTML Injection via Unvalidated
      Image MIME Type in Data-URL Interpolation
tags:
  - cve.org
epss: 0.00157
epssPercentile: 0.04927
ingestedAt: '2026-11-08T14:51:22.459Z'
---

## Overview

OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting malicious mimeType values in image content blocks. Attackers can craft session entries with specially crafted mimeType attributes that break out of the img src data-URL context to achieve cross-site scripting when exported HTML is opened.

## Affected

- `OpenClaw < 2026.2.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.