CVE-2026-10219: fallo de gravedad media en nextlevelbuilder GoClaw
nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 1.5%
A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the component write_file Tool. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
nextlevelbuilder · GoClawPoCs públicas encontradas — 1
cve_referencegithub.com/nextlevelbuilder/goclaw/issues/1121no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — nextlevelbuilder GoClaw
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-15625MEDIUMnextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklistEPSS 0.5%CVE-2026-16124MEDIUMnextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgeryEPSS 0.5%CVE-2026-15626MEDIUMnextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversalEPSS 0.4%CVE-2026-15627MEDIUMnextlevelbuilder GoClaw tool.go handleNavigate information disclosureEPSS 0.4%CVE-2026-16120MEDIUMnextlevelbuilder GoClaw exec_approval.go extractBin name resolutionEPSS 0.4%CVE-2026-10617MEDIUMnextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authenticationEPSS 0.4%