A critical arbitrary code execution vulnerability in OpenClaw allows attackers to execute malicious commands by manipulating .npmrc configuration files during the installation process.

This vulnerability involves the insecure acceptance of untrusted configuration data, specifically within the git dependency handling of npm installations. An unauthenticated attacker can achieve code execution by crafting a malicious .npmrc file that forces the system to execute arbitrary programs when plugins or hooks are installed.

The ability for an attacker to execute arbitrary code on a system hosting OpenClaw poses a severe risk to organizational security, potentially leading to full system compromise or unauthorized access to sensitive data. With a CVSS score of 7.8, this high-severity flaw represents a significant threat to internal environments where local plugin installation is a standard administrative or development task.

Immediate Action: Update the OpenClaw package to version 2026.3.24 or later to address the insecure configuration parsing logic.

Proactive Monitoring: Monitor system logs for unexpected git process execution or unauthorized modifications to .npmrc files within project directories.

Compensating Controls: Restrict the ability of untrusted users to perform local plugin installations and ensure that all external dependencies are audited before being introduced into the build environment.

Public Exploit Available: Unknown.

Given the potential for total system impact and the existence of a proof-of-concept, administrators should prioritize updating OpenClaw to version 2026.3.24 immediately. Failure to remediate this flaw exposes the host system to code execution attacks during routine maintenance or deployment activities.