Is CVE-2026-35641 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-35641, but active exploitation has not been confirmed.

Can CVE-2026-35641 be exploited remotely?

No. CVE-2026-35641 requires local access to exploit.

What is the CVSS score of CVE-2026-35641?

CVE-2026-35641 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-35641

HIGHPOC

CVE-2026-35641

CWE-349Published: April 10, 2026· Updated: Apr 14, 2026

7.8

CVSS v3.1

Official Description

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can leverage git dependencies to trigger execution of arbitrary programs specified in the attacker-controlled .npmrc configuration file.

NVD Source

Technical Analysis

CVE-2026-35641 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

A proof-of-concept (PoC) exploit exists for CVE-2026-35641. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.