OpenClaw CVE-2026-53841

Exploitation requires two specific, simultaneous conditions: (1) the attacker must be able to inject or supply content into an OpenClaw session - this requires either session collaboration access, control over an external data source ingested by the session, or another mechanism to influence session content; and (2) a trusted operator must export the session to HTML and actively click the crafted link in a JavaScript-enabled browser. The CVSS 4.0 AT:P metric explicitly confirms that specific attack prerequisites must be present. Exploitation is further limited by the requirement for deliberate user interaction beyond simply opening the file (the victim must click the malicious link), and by the scope of impact being confined to the operator's browser context (SC:L/SI:L). This vulnerability is not exploitable remotely against default OpenClaw deployments without the attacker first gaining influence over session content.

The CVSS 4.0 score of 2.1 is low and accurately reflects several compounding mitigating factors. The AT:P metric confirms specific attack prerequisites must be satisfied before exploitation is possible. The UI:A metric requires the victim to actively click the crafted link - merely opening the file is insufficient. The vulnerable system shows no CIA impact (VC:N/VI:N/VA:N), with only low subsequent-system confidentiality and integrity impact (SC:L/SI:L). No CISA KEV listing and no public proof-of-concept exploit exist at time of analysis, and no EPSS score was supplied in the source data, so exploitation probability cannot be quantified from that signal. Despite the low CVSS score, the scenario carries a meaningful insider or supply-chain-style risk dimension that CVSS does not fully capture: an attacker who can influence session content (e.g., a malicious collaborator) can effectively target privileged operators who routinely export and review sessions. This is a real but narrow priority - not a broadly exploitable internet-facing vulnerability.

An attacker with the ability to contribute content to an OpenClaw session - for example, a malicious internal collaborator or a compromised data source ingested by the session - embeds an anchor tag containing a javascript: or data: URI in the session content. When a trusted operator later exports the session to HTML for offline review and clicks the link in their browser, the embedded script executes in the operator's browser context, where it could exfiltrate session cookies, perform credentialed API calls, or redirect the operator to a phishing page. No public proof-of-concept exploit has been identified at time of analysis.