{"action":"Upgrade openclaw to 2026.2.23 or later.","affected":[{"fixed":"2026.2.23","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.23"],"ghsa_id":"GHSA-r294-2894-92j3","id":"tcs_01M5KG7KTQQ2DKD5QZQ4CBZD2K","modified_at":"2026-03-04T15:16:22.593407Z","published_at":"2026-03-03T22:09:26Z","references":["https://osv.dev/vulnerability/GHSA-r294-2894-92j3","https://github.com/openclaw/openclaw/security/advisories/GHSA-r294-2894-92j3","https://github.com/openclaw/openclaw/commit/f8524ec77a3999d573e6c6b8a5055bf35c49a2e6","https://github.com/openclaw/openclaw"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-r294-2894-92j3","url":"https://osv.dev/vulnerability/GHSA-r294-2894-92j3"}],"summary":"OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering"}