CVE-2026-35641 - Vulnerability Analysis

Overview

OpenClaw before 2026.3.24 contains a command injection vulnerability caused by crafted .npmrc file with git executable override in local plugin and hook installation, letting attackers execute arbitrary code during npm install, exploit requires attacker to craft malicious .npmrc file.

Severity & Score

Impact

Attackers can execute arbitrary code during npm install, potentially leading to full system compromise.

Mitigation

Update to version 2026.3.24 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw
• https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-npmrc-in-local-plugin-hook-installation

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 11, 2026

🟠 CVE-2026-35641 - High (7.8) OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install executi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35641/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner