GHSA-2ww6-868g-2c56: OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation

March 3, 2026

The HTML session exporter (src/auto-reply/reply/export-html/template.js) interpolates img.mimeType directly into <img src="data:..."> attributes without validation or escaping. A crafted mimeType value (e.g., x" onerror="alert(1)) can break out of the attribute context and execute arbitrary JavaScript.

References

github.com/advisories/GHSA-2ww6-868g-2c56
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/f3adf142c195000cbde31200626a1d8c8b716df9
github.com/openclaw/openclaw/pull/24140
github.com/openclaw/openclaw/security/advisories/GHSA-2ww6-868g-2c56

Code Behaviors & Features

Detect and mitigate GHSA-2ww6-868g-2c56 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →