GHSA-m3mh-3mpg-37hw: OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

March 30, 2026

During the installation phase of OpenClaw local plugins/hooks, the Git executable can be hijacked by a project-level .npmrc file, leading to arbitrary code execution during installation.

References

github.com/advisories/GHSA-m3mh-3mpg-37hw
github.com/openclaw/openclaw
github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw

Code Behaviors & Features

Detect and mitigate GHSA-m3mh-3mpg-37hw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →