CVE-2026-35641: OpenClaw RCE via .npmrc override

CISO Take

OpenClaw before 2026.3.24 allows arbitrary code execution when installing local plugins or hooks: a crafted .npmrc file in the staged package directory can redirect the git executable to any attacker-controlled binary, which npm then invokes during dependency resolution — with the installing user's full privileges. While the CVSS 7.8 score reflects a local, user-interaction-required attack, this is precisely how plugin managers operate, making the 'user interaction' threshold trivially met in normal developer workflows. The EPSS percentile places this in the top 3% of all CVEs by exploitation likelihood, and AIID incident #1368 already documents an active Feb. 2026 campaign where roughly 17% of OpenClaw skills on ClawHub delivered credential-stealing malware (AMOS stealer), confirming this plugin ecosystem is a live attack surface — not a theoretical one. Patch to 2026.3.24 immediately, audit staged plugin directories for unexpected .npmrc files, and restrict plugin installs to vetted internal registries.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS AIID

What is the risk?

High-priority despite the local attack vector. The EPSS 97th percentile indicates this class of vulnerability sees disproportionate real-world exploitation relative to the broader CVE universe. Critically, the OpenClaw plugin ecosystem is already an active attack surface per AIID #1368 — removing the theoretical-only caveat typically applied to supply chain CVEs. Attack complexity is Low with no privileges required, meaning any malicious skill author can weaponize this; the 'user interaction required' flag maps directly to the expected behavior of installing community skills. The 396 CVEs associated with this package family signal a historically weak security posture that elevates confidence in active exploitation attempts.

How does the attack unfold?

Malicious Plugin Distribution

Attacker publishes a weaponized OpenClaw skill or hook to ClawHub or convinces a target to install a locally crafted plugin package.

AML.T0011.001

Configuration Injection via .npmrc

The malicious package includes a crafted .npmrc file that overrides the git executable path to point to an attacker-controlled binary placed within the staged package directory.

AML.T0081

Arbitrary Code Execution

OpenClaw's plugin manager runs npm install in the staged directory; npm reads the .npmrc override and executes the malicious git-stub binary with the installing user's privileges.

AML.T0050

Credential Exfiltration

The attacker-controlled binary harvests API keys, SSH keys, environment variables, and browser-stored credentials from the host, then exfiltrates them to attacker-controlled infrastructure.

AML.T0025

Malicious Plugin Distribution

Attacker publishes a weaponized OpenClaw skill or hook to ClawHub or convinces a target to install a locally crafted plugin package.

AML.T0011.001

Configuration Injection via .npmrc

The malicious package includes a crafted .npmrc file that overrides the git executable path to point to an attacker-controlled binary placed within the staged package directory.

AML.T0081

Arbitrary Code Execution

OpenClaw's plugin manager runs npm install in the staged directory; npm reads the .npmrc override and executes the malicious git-stub binary with the installing user's privileges.

AML.T0050

Credential Exfiltration

The attacker-controlled binary harvests API keys, SSH keys, environment variables, and browser-stored credentials from the host, then exfiltrates them to attacker-controlled infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to 2026.3.24 or later — this is the only complete remediation.
Audit: inspect all staged plugin and hook directories for unexpected .npmrc files; any entry overriding the 'git' executable is an indicator of compromise requiring incident response.
Restrict sources: disable community/ClawHub plugin auto-install in production or untrusted environments; allowlist only internal or cryptographically verified plugins.
Least privilege: run OpenClaw under a dedicated low-privilege service account to limit blast radius if exploitation occurs.
Detect: deploy filesystem integrity monitoring (auditd, Falco, or equivalent) on npm install paths used by OpenClaw; alert on .npmrc creation in plugin staging directories.
Validate: cross-check installed skill manifests against known-good hashes before promotion to production environments.

How is it classified?

Supply Chain Code Execution Agent Plugin AML.T0010.005 - AI Agent Tool AML.T0011.001 - Malicious Package AML.T0081 - Modify AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk Management System

ISO 42001

A.6.1.5 - AI system supply chain security

NIST AI RMF

GOVERN-6.1 - Supply Chain and Third-Party Risk

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-35641?

OpenClaw before 2026.3.24 allows arbitrary code execution when installing local plugins or hooks: a crafted .npmrc file in the staged package directory can redirect the git executable to any attacker-controlled binary, which npm then invokes during dependency resolution — with the installing user's full privileges. While the CVSS 7.8 score reflects a local, user-interaction-required attack, this is precisely how plugin managers operate, making the 'user interaction' threshold trivially met in normal developer workflows. The EPSS percentile places this in the top 3% of all CVEs by exploitation likelihood, and AIID incident #1368 already documents an active Feb. 2026 campaign where roughly 17% of OpenClaw skills on ClawHub delivered credential-stealing malware (AMOS stealer), confirming this plugin ecosystem is a live attack surface — not a theoretical one. Patch to 2026.3.24 immediately, audit staged plugin directories for unexpected .npmrc files, and restrict plugin installs to vetted internal registries.

Is CVE-2026-35641 actively exploited?

No confirmed active exploitation of CVE-2026-35641 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35641?

1. Patch immediately: upgrade OpenClaw to 2026.3.24 or later — this is the only complete remediation. 2. Audit: inspect all staged plugin and hook directories for unexpected .npmrc files; any entry overriding the 'git' executable is an indicator of compromise requiring incident response. 3. Restrict sources: disable community/ClawHub plugin auto-install in production or untrusted environments; allowlist only internal or cryptographically verified plugins. 4. Least privilege: run OpenClaw under a dedicated low-privilege service account to limit blast radius if exploitation occurs. 5. Detect: deploy filesystem integrity monitoring (auditd, Falco, or equivalent) on npm install paths used by OpenClaw; alert on .npmrc creation in plugin staging directories. 6. Validate: cross-check installed skill manifests against known-good hashes before promotion to production environments.

What systems are affected by CVE-2026-35641?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin systems, local AI agent deployments, AI developer workstations, agentic CI/CD pipelines.

What is the CVSS score for CVE-2026-35641?

CVE-2026-35641 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin systemslocal AI agent deploymentsAI developer workstationsagentic CI/CD pipelines

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0011.001 Malicious Package

AML.T0081 Modify AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.1.5

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.

Exploitation Scenario

A threat actor publishes a malicious OpenClaw skill to ClawHub — consistent with the AIID #1368 campaign pattern where ~17% of sampled skills were assessed as malicious. The skill package includes a crafted .npmrc that sets 'git=/tmp/.hidden/evil_binary', pointing to an attacker-controlled executable. When a developer or automated pipeline installs the skill via OpenClaw's plugin manager, the tool runs npm install in the staged package directory to resolve git-based dependencies; npm reads the .npmrc override and executes the malicious binary with the installing user's privileges. The binary then harvests API keys, environment variables, SSH keys, and browser-stored credentials from the developer workstation — replicating the AMOS stealer exfiltration behavior documented in AIID #1368 — and phones home to attacker-controlled C2 infrastructure.

Weaknesses (CWE)

CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

CWE-349 — Acceptance of Extraneous Untrusted Data With Trusted Data: The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Source: MITRE CWE corpus.