CVE-2026-35641

OVERVIEW CVE-2026-35641 affects OpenClaw versions prior to 2026.3.24 and involves an arbitrary code execution vulnerability in the local plugin and hook installation mechanism. The vulnerability stems from improper handling of .npmrc files during npm install operations, allowing attackers to override the git executable and execute malicious code through crafted git dependencies. SEVERITY This vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector requiring user interaction but no special privileges. The attack has low complexity and delivers high impact across confidentiality, integrity, and availability. A user must interact with the affected system, typically by running npm install in a directory containing an attacker-controlled .npmrc file, to trigger exploitation. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking hot lists. However, the EPSS score of 0.000070 indicates this threat ranks in the lower percentile of all CVEs, suggesting limited immediate concern. Organizations should prioritize patching to OpenClaw 2026.3.24 or later as a precautionary measure.