PT-2026-51530 · Nanocoai · Nanoclaw

Chia Min Jun Lennon · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-56692

NVD

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName before copying with fs.copyFileSync, which follows symlinks without containment checks, allowing malicious agents to disclose arbitrary host files.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-56692

Affected Products

Nanoclaw

References · 4

• https://github.com/nanocoai/nanoclaw/commit/28032bc0eca76c91fb3d8be0013e8bcaf2f5aeae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56692 · Security Note
• https://github.com/nanocoai/nanoclaw/pull/2468 · Note
• https://vulncheck.com/advisories/nanoclaw-arbitrary-file-read-via-symlink-following-in-forwardattachedfiles · Note