Attack Chain

1. Attacker crafts a malicious OpenClaw workspace.
2. Within the workspace, the attacker creates a .env file.
3. The .env file contains the line OPENCLAW_BUNDLED_PLUGINS_DIR=/path/to/attacker/plugins.
4. The attacker places malicious plugins in the directory specified by /path/to/attacker/plugins. These could be JavaScript or other executable formats depending on OpenClaw's plugin architecture.
5. The attacker distributes the malicious workspace to a victim. This could be via email, shared storage, or other means.
6. The victim opens the malicious workspace with a vulnerable version of OpenClaw (<= 2026.3.28).
7. OpenClaw reads the .env file and sets the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable accordingly.
8. OpenClaw loads and executes the attacker-controlled plugins from the specified directory, leading to arbitrary code execution within the context of the OpenClaw process.

Impact

Successful exploitation allows an attacker to execute arbitrary code within the OpenClaw environment. The impact could include data theft, modification of workspace files, or further compromise of the victim's system. The severity is tied to user interaction as the victim must open the attacker-crafted workspace. While the number of affected users is not specified in the advisory, organizations using OpenClaw for sensitive projects are most at risk.

Recommendation

• Upgrade OpenClaw to version 2026.3.31 or later to remediate the vulnerability.
• Deploy the Sigma rule Detect OpenClaw Plugin Directory Override to detect attempts to override the plugin directory via .env files.
• Implement file integrity monitoring for OpenClaw workspaces to detect unauthorized modifications to .env files.
• Educate users about the risks of opening workspaces from untrusted sources.