📄 Description (English)
OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.
🤖 AI Executive Summary
CVE-2026-35641 is a critical arbitrary code execution vulnerability in OpenClaw before version 2026.3.24 that allows attackers to execute malicious code through crafted .npmrc files during npm package installation. The vulnerability exploits git dependency resolution mechanisms, enabling remote code execution with the privileges of the npm process. With public exploits available and no patch currently released, this poses an immediate threat to development environments and CI/CD pipelines across Saudi organizations.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 27, 2026 17:40
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses significant risk to Saudi technology sector organizations, particularly: (1) Financial institutions and FinTech companies using Node.js development stacks for banking applications and payment processing systems regulated by SAMA; (2) Government agencies and digital transformation initiatives under NCA oversight that rely on npm-based development; (3) Telecommunications providers (STC, Mobily, Zain) managing critical infrastructure through Node.js applications; (4) Energy sector organizations including ARAMCO subsidiaries using npm packages in operational technology; (5) Healthcare providers implementing digital health systems with Node.js backends. The vulnerability is particularly dangerous in shared development environments and CI/CD pipelines common in Saudi enterprises.
🏢 Affected Saudi Sectors
Banking and Financial Services
Government and Public Administration
Telecommunications
Energy and Utilities
Healthcare
Technology and Software Development
E-commerce and Retail
🎯 MITRE ATT&CK Techniques
T1190 - Exploit Public-Facing Application
T1195 - Supply Chain Compromise
T1195.001 - Compromise Software Dependencies
T1059.007 - Command and Scripting Interpreter: JavaScript/Node.js
T1547.013 - Boot or Logon Initialization Scripts: XDG Autostart Entries
T1036.005 - Masquerading: Match Legitimate Name or Location
T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking
⚖️ Saudi Risk Score (AI)
8.7
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Audit all Node.js projects and CI/CD pipelines for OpenClaw usage and npm dependency chains
2. Restrict .npmrc file creation and modification permissions in development and build environments
3. Implement strict file integrity monitoring on .npmrc files across all systems
4. Isolate affected development environments from production networks immediately
COMPENSATING CONTROLS (until patch available):
1. Disable git-based npm dependencies; use only published npm registry packages with integrity verification
2. Implement npm audit and npm ci with --prefer-offline flag to prevent dynamic dependency resolution
3. Use npm lockfile (package-lock.json) with integrity hashes and enforce --frozen-lockfile in CI/CD
4. Configure npm to use private registry mirrors with strict package whitelisting
5. Implement process-level sandboxing for npm install operations using containers or VMs
6. Enforce code signing and verification for all npm packages before installation
DETECTION RULES:
1. Monitor for .npmrc file creation/modification in project directories and CI/CD workspaces
2. Alert on npm install commands with git:// protocol dependencies
3. Track execution of unexpected binaries spawned from npm processes
4. Monitor for git executable overrides in environment variables or configuration files
5. Log all npm registry access and flag non-standard registry configurations
PATCHING STRATEGY:
1. Subscribe to OpenClaw security advisories for patch release notification
2. Prepare upgrade plan to version 2026.3.24 or later immediately upon release
3. Test patches in isolated development environment before production deployment
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع مشاريع Node.js وخطوط أنابيب CI/CD للتحقق من استخدام OpenClaw وسلاسل تبعيات npm
2. تقييد صلاحيات إنشاء وتعديل ملفات .npmrc في بيئات التطوير والبناء
3. تنفيذ مراقبة سلامة الملفات الصارمة على ملفات .npmrc عبر جميع الأنظمة
4. عزل بيئات التطوير المتأثرة عن شبكات الإنتاج فوراً
الضوابط التعويضية (حتى توفر التصحيح):
1. تعطيل تبعيات npm المستندة إلى git؛ استخدام حزم سجل npm المنشورة فقط مع التحقق من السلامة
2. تنفيذ npm audit و npm ci مع علم --prefer-offline لمنع حل التبعيات الديناميكية
3. استخدام ملف قفل npm (package-lock.json) مع تجزئات السلامة وفرض --frozen-lockfile في CI/CD
4. تكوين npm لاستخدام مرايا السجل الخاصة مع قائمة بيضاء صارمة للحزم
5. تنفيذ الحماية على مستوى العملية لعمليات npm install باستخدام الحاويات أو الأجهزة الافتراضية
6. فرض التوقيع والتحقق من الأكواد لجميع حزم npm قبل التثبيت
قواعد الكشف:
1. مراقبة إنشاء/تعديل ملفات .npmrc في دلائل المشاريع وأماكن عمل CI/CD
2. تنبيهات على أوامر npm install مع تبعيات بروتوكول git://
3. تتبع تنفيذ الملفات الثنائية غير المتوقعة التي تم إطلاقها من عمليات npm
4. مراقبة تجاوزات ملف git القابل للتنفيذ في متغيرات البيئة أو ملفات التكوين
5. تسجيل جميع عمليات الوصول إلى سجل npm والإشارة إلى تكوينات السجل غير القياسية
استراتيجية التصحيح:
1. الاشتراك في تنبيهات أمان OpenClaw لإخطار إصدار التصحيح
2. تحضير خطة الترقية إلى الإصدار 2026.3.24 أو أحدث فوراً عند الإصدار
3. اختبار التصحيحات في بيئة التطوير المعزولة قبل نشر الإنتاج
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.14.2.1 - Secure development policy and procedures
ECC 2024 A.14.2.5 - Secure development environment
ECC 2024 A.12.6.1 - Management of technical vulnerabilities
ECC 2024 A.12.2.1 - Monitoring and logging of access to information
🔵 SAMA CSF
SAMA CSF ID.BE-3.1 - Supply chain risk management
SAMA CSF PR.DS-6 - Data security and integrity
SAMA CSF DE.CM-1 - Detection processes and tools
SAMA CSF RS.MI-2 - Incident response and recovery
🟡 ISO 27001:2022
ISO 27001:2022 A.8.1.1 - Information security policies
ISO 27001:2022 A.8.2.3 - Segregation of duties
ISO 27001:2022 A.14.2.1 - Secure development policy
ISO 27001:2022 A.14.2.5 - Secure development environment
ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Security patches and updates
PCI DSS 6.3.2 - Code review and testing
PCI DSS 12.2.1 - Security policies and procedures
🔗 References & Sources 3
🔗
https://github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw
disclosure@vulncheck.com
Exploit
Mitigation
Vendor Advisory
🔗
https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-npmrc-in-loc...
disclosure@vulncheck.com
Third Party Advisory
🔗
https://github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw
134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit
Mitigation
Vendor Advisory
📦 Affected Products / CPE 1 entries
openclaw:openclaw