Openclaw cli: OpenClaw: Exported session HTML could keep unsafe markdown links (CVE-2026-53841)

The vulnerability CVE-2026-53841 in openclaw-cli affects versions >=2026.1.29 and <2026.5.12. Exported session HTML files can preserve unsafe markdown links containing javascript: or data: schemes, which may execute browser-side scripts when opened by a trusted operator. This issue is scoped to the exported session HTML feature and does not alter the trusted-operator security model of OpenClaw. The practical risk depends on whether untrusted input can reach the export path and the operator's environment. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) and is patched starting with version 2026.5.12.

If a trusted operator opens an exported session HTML file containing unsafe markdown links, browser-side script execution could occur. This may lead to limited confidentiality and integrity impacts within the operator's environment. The vulnerability requires user interaction (UI:R) and network attack vector (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N). There are no known exploits in the wild. The impact is limited to the context where the exported file is opened and the unsafe links activated.

A patch is available in openclaw-cli version 2026.5.12. Users should upgrade to this version to remediate the vulnerability. Until patched, do not open exported session HTML files from untrusted sources in privileged browser profiles. Additionally, restrict Gateway and tool allowlists, avoid sharing Gateways between mutually untrusted users, and disable the exported session HTML feature when not needed.