GitHub Advisoryadvisory · Go

GHSA-6jm8-4fhr-5w64 GoClaw has a Command Injection issue

MEDIUM Published 2026-06-01 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-10219
Ecosystem
Go
Packages
github.com/nextlevelbuilder/goclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77
Reviewed
2026-07-09

Affected packages

• Go github.com/nextlevelbuilder/goclaw: <= 3.11.3 (no fix yet)

Description

A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the component write_file Tool. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Related

Alias · CVE (1)

  • CVE-2026-10219 A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References