📄 الوصف (الإنجليزية)
OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.
🤖
في طابور التحليل الذكي
سيتم تحليل هذا CVE تلقائياً في المهام المجدولة.
🔗 المراجع والمصادر 3
🔗
https://github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw
disclosure@vulncheck.com
Exploit
Mitigation
Vendor Advisory
🔗
https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-npmrc-in-loc...
disclosure@vulncheck.com
Third Party Advisory
🔗
https://github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw
134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit
Mitigation
Vendor Advisory
📦 المنتجات المتأثرة 1 منتج
openclaw:openclaw