CVE-2026-41336: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41336 is a code inclusion vulnerability in OpenClaw (npm package) that allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling an attacker to redirect hook loading to attacker-controlled code and achieve arbitrary code execution. All versions of the openclaw npm package up to and including v2026.3.28 are affected; the issue was fixed in v2026.3.31. The vulnerability was reported by researcher nexrin, sponsored by KeenSecurityLab, and disclosed on March 31, 2026, with CVE assignment on April 23, 2026. It carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): OpenClaw's dotenv loading logic did not block workspace-level .env files from setting the OPENCLAW_BUNDLED_HOOKS_DIR (and related OPENCLAW_BUNDLED_PLUGINS_DIR, OPENCLAW_BUNDLED_SKILLS_DIR) environment variables, which control where the application loads trusted bundled hook code from. An attacker crafts a malicious workspace containing a .env file that sets OPENCLAW_BUNDLED_HOOKS_DIR=./attacker-hooks, pointing to attacker-supplied hook scripts. When a victim user opens or interacts with the workspace, OpenClaw loads the attacker's hook code in place of the trusted bundled defaults, executing it with the user's privileges. The fix (commit 330a9f9) adds these variables to a BLOCKED_WORKSPACE_DOTENV_KEYS denylist, preventing workspace .env files from overriding them (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary code execution with the privileges of the victim user who opens the malicious workspace, yielding high confidentiality, integrity, and availability impact on the affected system. An attacker can read sensitive files and credentials accessible to the user, modify or delete data, and disrupt availability. Because no elevated privileges are required to craft the malicious workspace, the attack surface includes any user who opens an untrusted OpenClaw workspace, making supply-chain or social-engineering delivery vectors realistic (Github Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction — a victim must open a malicious workspace — which limits opportunistic exploitation but does not preclude targeted attacks via shared or distributed workspaces.

1. Craft malicious workspace: Create an OpenClaw workspace directory containing a .env file with the entry OPENCLAW_BUNDLED_HOOKS_DIR=./attacker-hooks (and optionally OPENCLAW_BUNDLED_PLUGINS_DIR=./attacker-plugins, OPENCLAW_BUNDLED_SKILLS_DIR=./attacker-skills).
2. Place attacker hook code: Populate the ./attacker-hooks directory within the workspace with malicious hook scripts (e.g., Node.js files) that execute the desired payload — such as a reverse shell, credential harvester, or persistence mechanism.
3. Deliver the workspace: Distribute the malicious workspace to the target user via a shared repository, archive file, or social engineering (e.g., a fake project or template).
4. Trigger execution: When the victim opens the workspace in a vulnerable version of OpenClaw (≤2026.3.28), the application loads the workspace .env file and sets OPENCLAW_BUNDLED_HOOKS_DIR to the attacker-controlled path.
5. Achieve code execution: OpenClaw loads and executes the attacker's hook code in place of the trusted bundled hooks, running the payload with the victim user's OS privileges (GitHub Advisory, Fix Commit).

• File System: Presence of a .env file in a workspace directory containing entries for OPENCLAW_BUNDLED_HOOKS_DIR, OPENCLAW_BUNDLED_PLUGINS_DIR, or OPENCLAW_BUNDLED_SKILLS_DIR pointing to non-standard or relative paths; unexpected directories named attacker-hooks, attacker-plugins, or attacker-skills within workspace folders; unfamiliar or unsigned hook/plugin script files in workspace subdirectories.
• Process: Unexpected child processes spawned by the OpenClaw Node.js process (e.g., shell commands, network utilities like curl, wget, or nc); unusual outbound network connections originating from the OpenClaw process.
• Logs: OpenClaw application logs referencing hook or plugin directories outside the standard installation path; environment variable resolution logs showing OPENCLAW_BUNDLED_HOOKS_DIR set to a workspace-relative path.

Users should upgrade the openclaw npm package to version 2026.3.31 or later, which blocks workspace .env files from overriding OPENCLAW_BUNDLED_HOOKS_DIR, OPENCLAW_BUNDLED_PLUGINS_DIR, and OPENCLAW_BUNDLED_SKILLS_DIR via a denylist (GitHub Advisory, Fix Commit). As an interim workaround prior to patching, users should avoid opening workspaces from untrusted or unknown sources, and should inspect any workspace .env files for suspicious entries before loading them. Existing workspaces should be audited for unexpected .env modifications that reference non-standard hook or plugin directories.

The vulnerability was reported by researcher nexrin and sponsored by KeenSecurityLab, with the fix credited to contributor vincentkoc (GitHub Advisory). VulnCheck published an advisory covering the issue. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking sites.