OpenClaw exported session content through installed HTML templates that did not validate image MIME values. The repair limits the MIME values used when rendering exported images.

@@ -0,0 +69,18 @@+  return fs.readFileSync(path.join(getExportDir(), fileName), "utf-8");+}++function generateHtml(sessionData: SessionData): string {+  const template = loadTemplate("template.html");+  const templateCss = loadTemplate("template.css");+  const templateJs = loadTemplate("template.js");+  const markedJs = loadTemplate(path.join("vendor", "marked.min.js"));+  const hljsJs = loadTemplate(path.join("vendor", "highlight.min.js"));+

+  // Use default theme colors+  const themeVars = `+    --bg: #1a1a2e;+    --fg: #eaeaea;+    --userMessageBg: #2d2d44;+    --assistantMessageBg: #1e1e30;+    --toolCallBg: #252538;+    --toolResultBg: #1c1c2c;

@@ -664,9 +664,18 @@     div.textContent = text;     return div.innerHTML;   } +  // Validate image MIME type to prevent attribute injection in data-URL src.+  const SAFE_IMAGE_MIME_RE = /^image\/(png|jpeg|gif|webp|svg\+xml|bmp|tiff|avif)$/i;+  function sanitizeImageMimeType(mimeType) {+    if (typeof mimeType === "string" && SAFE_IMAGE_MIME_RE.test(mimeType)) {+      return mimeType;+    }

+    return "application/octet-stream";+  }+   /**    * Truncate string to maxLen chars, append "..." if truncated.    */   function truncate(s, maxLen = 100) {     if (s.length <= maxLen) {