PT-2026-51530 · Nanocoai · Nanoclaw

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-56692

NVD

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName before copying with fs.copyFileSync, which follows symlinks without containment checks, allowing malicious agents to disclose arbitrary host files.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2026-56692

Produtos afetados

Nanoclaw

Referências · 4

• https://github.com/nanocoai/nanoclaw/commit/28032bc0eca76c91fb3d8be0013e8bcaf2f5aeae · Correção
• https://github.com/nanocoai/nanoclaw/pull/2468 · Nota
• https://vulncheck.com/advisories/nanoclaw-arbitrary-file-read-via-symlink-following-in-forwardattachedfiles · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56692 · Nota de Segurança