EUVD-2026-33540
GHSA-6jm8-4fhr-5w64
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the component write_file Tool. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shell commands inside the sandbox container by supplying a crafted file path to the write_file tool. The flaw exists in FsBridge.WriteFile (internal/sandbox/fsbridge.go), which interpolated the destination path into a shell command (sh -c "cat > <path>") executed via docker exec, letting shell metacharacters such as $(...) break out of the intended write operation. Publicly available exploit code exists and the upstream patch is still pending merge at the time of analysis, raising real-world risk despite a moderate 7.3 CVSS.
Technical ContextAI
GoClaw is an agentic coding tool from nextlevelbuilder that brokers filesystem operations into a Docker sandbox through an FsBridge abstraction. The vulnerable WriteFile path used b.dockerExec(ctx, []byte(content), "sh", "-c", fmt.Sprintf("cat %s %q", redir, resolved)), invoking a shell inside the container with the resolved file path embedded as a %q-quoted token. While %q adds Go-style quoting, it does not neutralize POSIX shell command substitution constructs like $(...) and backticks, so any caller able to influence the target path could inject commands - the classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) failure. The fix in PR #1155 removes the shell entirely, switching to tee [-a] -- <path> invoked directly via argv so the path is a discrete argument and metacharacters are no longer interpreted by a shell. The single affected CPE is cpe:2.3:a:nextlevelbuilder:goclaw:*.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is in https://github.com/nextlevelbuilder/goclaw/pull/1155, which replaces the sh -c "cat > <path>" invocation with a direct tee [-a] -- <resolved> argv call so paths are never reparsed by a shell, but the PR description notes it awaits acceptance and no tagged release beyond 3.11.3 is referenced in the input data. Until the PR is merged and a release ships, operators should pin to an internal build that applies the PR diff, or disable the write_file tool in the agent's tool registry if the workload can tolerate read-only operation (trade-off: the agent loses the ability to create or modify files in the sandbox). Additional compensating controls: refuse or sanitize any tool input where the path argument contains shell metacharacters ($, backtick, ;, &, |, newline) before it reaches FsBridge, and ensure the Docker sandbox runs with a non-root user, read-only host mounts, and no outbound network so that successful in-container command execution has the smallest possible blast radius. Monitor the upstream issue at https://github.com/nextlevelbuilder/goclaw/issues/1121 and PR https://github.com/nextlevelbuilder/goclaw/pull/1155 for release news.
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Improper authorization in GoClaw (nextlevelbuilder/goclaw) up to version 3.11.3 allows a remote low-privileged attacker
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today