Arbitrary Code Execution Vulnerability in OpenClaw from OpenClaw

CVE-2026-35641

What is CVE-2026-35641?

OpenClaw versions prior to 2026.3.24 are susceptible to an arbitrary code execution vulnerability that arises from improper handling of local plugin and hook installations. Attackers can exploit this weakness by creating a malicious .npmrc file that specifies a git executable override. When a user performs an npm install in the affected package directory, the attacker's .npmrc can be executed, resulting in the execution of arbitrary code specified within the file. This vulnerability presents a significant risk, as it allows attackers to potentially control the system where OpenClaw is installed through malicious code execution.

References