CVE-2026-35641: OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

March 30, 2026 (updated April 10, 2026)

During the installation phase of OpenClaw local plugins/hooks, the Git executable can be hijacked by a project-level .npmrc file, leading to arbitrary code execution during installation.

References

github.com/advisories/GHSA-m3mh-3mpg-37hw
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw
nvd.nist.gov/vuln/detail/CVE-2026-35641

Code Behaviors & Features

Detect and mitigate CVE-2026-35641 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →